A forum for reverse engineering, OS internals and malware analysis 

ZeroAccess (alias MaxPlus, Sirefef)

Forum for analysis and discussion about malware.

Re: ZeroAccess (alias MaxPlus, Sirefef)

 #21594  by patriq
 Fri Dec 06, 2013 6:09 pm
frame4-mdpro wrote:"Disrupt" being the operative word here, and not much else.
Yes, exactly.

ZeroAccess operates on a P2P C&C infrastructure.

Not so easy to take down since P2P is more resilient due to having many more C&C servers, and in some P2P botnets, any one of the clients could potentially be a C&C (Gameover Zeus I believe does this, not sure of ZeroAccess)

ZeroAccess bots are built with an initial list of hosts to call and ask for updates, more nodes, commands, etc.
The sample e60a5f26dbde304410eae802919cbf71 (posted here earlier) still reaches out to 100+ IP addresses, many of them are still online, operational.

https://malwr.com/analysis/ZGI0YzRlYjJi ... ljZGViMmM/
(VT 8/48)

Good work MSFT. 8-)

Re: ZeroAccess (alias MaxPlus, Sirefef)

 #21597  by markusg
 Fri Dec 06, 2013 7:37 pm
Microsoft and its partners do not expect to fully eliminate the ZeroAccess botnet due to the complexity of the threat. However, Microsoft expects that
this action will significantly disrupt the botnet’s operation. Microsoft is working with ecosystem partners around the world to notify people if their
and i think it needs also time to clean all pcs microsoft collect info about
  • 1
  • 47
  • 48
  • 49
  • 50
  • 51
  • 56
 Return to “Malware”