Conficker update with payload

Published: 2009-04-09
Last Updated: 2009-04-09 13:44:52 UTC
by Johannes Ullrich (Version: 1)
1 comment(s)

Various sources report that some conficker infected systems are receiving updates now. The update may include a keylogger and other code to exfiltrate data. We will keep this diary updates as we hear more. The update is delivered using the P2P mechanism and not the (disfunct) web sites.

 

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute     Follow me on Twitter

Keywords: conficker downadup keylogger
1 comment(s)

Comments

If the sucker is really using port 5114,
your own statistics do not show something special,
regarding peaks.
Maybe I would like to misinterprete the peaks.
http://www.dshield.org/portgraph.html?_jpg_csimd=1&token=&start_month=1&start_day=1&start_year=2009&end_month=4&end_day=10&end_year=2009&port=5114&leftgraph=tcpratio&rightgraph=reports&range=Y&submit=Update

Manuel

Apr 10th 2009
1 decade ago

Login here to join the discussion.


Top of page
Diary Archives