[gjf]

Looks like TDL4 obtains new infector mechanism. Unfortunately the article is in Russian.

[axl]

Do you have this sample?

Looks like TDL obtains new infector mechanism. Unfortunately the article is in Russian and there is no information does it concern TDL4 or TDL3.

[gjf]

No. But I believe someone will post it in near days.

[CodeAddiction]

"TDSS, for self-propagation through the network uses the most dangerous vulnerability in the computer - the user."

Yes. Very true.

[Fabian Wosar]

I just went through our submits and found a sample we got submitted yesterday. While the Kaspersky detection name doesn't match the general behavior is the same (scanning the sub net for free addresses, downloading TDL-4 as a payload, original file name was update.exe) so I assume this is a variant of the malware the blog post is talking about.

Detection of the downloader:

http://www.virustotal.com/file-scan/rep ... 1306968878

The detection of downloaded TDL-4 dropper (downloaded from http://94.60.123.34/service/scripts/files/aff_50045.dll):

http://www.virustotal.com/file-scan/rep ... 1306969204

Both the dropper as well as the downloader are included in the attachment.

[gjf]

Here is that infector.

[PX5]

Why so interesting, Vobfus started calling in TDL4 as part of its payload and working mechanism back in early march of 2010.

Why this author talk like no other network worm ever called in TDL4 before?

Or is it just too early and I have not had enough coffee?

[Petra]

In the meantime the article exists also in English, see here

[markusg]

dll.exe
http://www.virustotal.com/file-scan/rep ... 1307444423

[EP_X0FF]

dll.exe
http://www.virustotal.com/file-scan/rep ... 1307444423

[main]
version=0.03
aid=30041
sid=0
builddate=351
rnd=1960408961
[inject]
*=cmd.dll
* (x64)=cmd64.dll
[cmd]
srv=hxxps://lo4undreyk.com/;hxxps://sh01cilewk.com/;hxxps://cap01tchaa.com/;hxxps://kur1k0nona.com/;hxxps://u101mnay2k.com/
wsrv=hxxp://gnarenyawr.com/;hxxp://rinderwayr.com/;hxxp://jukdoout0.com/;hxxp://swltcho0.com/;hxxp://ranmjyuke.com/
psrv=hxxp://crj71ki813ck.com/
version=0.175

nothing new.