Author Topic: Conficker/Downadup news  (Read 30581 times)

0 Members and 1 Guest are viewing this topic.


January 14, 2009, 03:50:47 pm
Reply #1

Tigger`

  • Newbie

  • Offline
  • *

  • 6
Thanks for the info. :)

January 14, 2009, 05:59:55 pm
Reply #2

Serg

  • Special Members
  • Sr. Member

  • Offline
  • *

  • 132

January 14, 2009, 06:18:40 pm
Reply #3

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Based on F-Secure's latest blocklist I have checked all domains. I haven't found any domains where
I could a payload from.

Here is a list of resolvable domains.
Ruining the bad guy's day

January 15, 2009, 12:36:13 am
Reply #4

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
if someone finds a sample of the Conficker worm please post it on site so i can get a sample soon as posible

Please don't post malware samples in public boards. You can contact me by PM for a sample.
Ruining the bad guy's day

January 16, 2009, 09:26:41 pm
Reply #5

chopsforever

  • Newbie

  • Offline
  • *

  • 1
Has anyone been able to determine whether or not the algorithm produces a finite number of domains?  Anyone seen any in-depth analysis?

January 16, 2009, 11:31:16 pm
Reply #6

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Calculating the Size of the Downadup Outbreak
http://www.f-secure.com/weblog/archives/00001584.html

Today's calculation is a total of 8,976,038 infections worldwide and 353,495 unique IP addresses.

Ruining the bad guy's day

January 17, 2009, 11:12:23 am
Reply #7

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Ruining the bad guy's day

January 21, 2009, 03:46:34 pm
Reply #8

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Ruining the bad guy's day

January 23, 2009, 06:45:49 pm
Reply #9

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Some of the conficker domains mentioned in f-secure's latest blacklist

http://www.f-secure.com/weblog/archives/downadup_domain_blocklist_17_31.txt

resolve to the same ip addresses like latest Asprox domains.

Code: [Select]
fmhxqutvccr.org
fmkopswuzhj.biz
fnygfr.com
fuougcdv.org
fvwugekf.info
fwkbt.info
gbrpn.org
gbxpxugx.org
ghtileh.biz
gnyluuxneo.com

Asprox news

Latest Asprox domain at MDL

/EDIT

I am not the only one who discovered that.

http://www.matchent.com/wpress/?q=node/434
Ruining the bad guy's day


January 27, 2009, 02:28:56 pm
Reply #11

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Ruining the bad guy's day

January 28, 2009, 04:46:14 am
Reply #12

aaudi

  • Newbie

  • Offline
  • *

  • 4

January 30, 2009, 07:46:28 pm
Reply #13

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Downadup.B/Conflicker.B IP generation and domain name predictor tool
http://mnin.blogspot.com/2009/01/downatool-for-downadupbconflickerb.html

Quote
You can use it to predict the list of domain names that the worm will contact on a given date. Downadup.B uses a completely different algorithm for selecting IPs to attack with MS08-067. Fortunately, you can also use this tool to mimic the random IP address generation algorithm to predict which IPs the worm will attempt to attack.


Memory Injection Model
http://blog.threatexpert.com/2009/01/confickerdownadup-memory-injection.html
Ruining the bad guy's day

January 31, 2009, 01:04:51 pm
Reply #14

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
F-Secures' Preemptive Downadup Blocklist for February
http://www.f-secure.com/weblog/archives/00001593.html
Ruining the bad guy's day