Our services: SOFTWARE DEVELOPMENT,  WEB DEVELOPMENT, DATABASE DESIGN and ADMINISTRATION, ENHANCEMENT of EXISTING SOFTWARE, ENHANCEMENT of EXISTING WEB SITES, ENHANCEMENT of EXISTING DATABASE, GRAPHIC DESIGN – LOGOS, BANNERS, ICONS…, PHOTOGRAPHY: SHOOTING PHOTOS, IMPROVING AND RETOUCHING, VIDEO PRODUCTION: RECORDING VIDEOS, CREATE MOVIES, PUBLISHING, SEO – SEARCH ENGINES OPTIMISATION, SOCIAL NETWORKS – POSTS ON TWITTER, GOOGLE+, FACEBOOK, LINKEDIN.

           Search  Search  

Flashback Trojan – more info
  More iPad, Androids, Tablet PCs ... 

  SoftFern.com on Twitter   SoftFern.com on YouTube   SoftFern.com on flickr   SoftFern.com on Pinterest
SoftFern.com on Facebook   SoftFern.com on Google+   SoftFern.com on Tumblr   SoftFern.com on LinkedIn



Our services: SOFTWARE DEVELOPMENT,  WEB DEVELOPMENT, DATABASE DESIGN and ADMINISTRATION, ENHANCEMENT of EXISTING SOFTWARE, ENHANCEMENT of EXISTING WEB SITES, ENHANCEMENT of EXISTING DATABASE, GRAPHIC DESIGN – LOGOS, BANNERS, ICONS…, PHOTOGRAPHY: SHOOTING PHOTOS, IMPROVING AND RETOUCHING, VIDEO PRODUCTION: RECORDING VIDEOS, CREATE MOVIES, PUBLISHING, SEO – SEARCH ENGINES OPTIMISATION, SOCIAL NETWORKS – POSTS ON TWITTER, GOOGLE+, FACEBOOK, LINKEDIN.


Free wallpapers of the hottest girls of the 2014 Winter Olympics

Complete guide for Euro 2012’, about 300 hundred pages filled with comprehensive information about Euro 2012


Euro 12 - teams, managers, players, fixtures, referees, the brand new ‘Tango 12’ Adidas ball and much, much more. Few hundreds amazing photos.


E-books, free e-books, Euro 2012 e-books


Auckland events in photos at bonanz.com


1 500 photos of fun-run 'Ports of Auckland Round the Bays 2012' at bonanz.com


Ocean swim - more than 1 500 photos of State King of the Bays

 

SoftFern.com Forums BonaNZ.com forums

SoftFern.com Forums - articles, news, links 

 

BonaNZ.com Forums - articles, news, links 


Photos of State King of the Bays event at bonanz.com


‘Complete guide for Euro 2012’: Given profile all 368 footballers with their photos.
 
 


‘Complete guide for Euro 2012’: Read about star players of each squad. Find out who is the key player of each team. What Pele expects of Euro 2012?



‘Complete guide for Euro 2012’: Compare annual salary of coaches participating in the Euro-2012 - and how it happened that the team of the most paid coach finished the last in their group?




‘Complete guide for Euro 2012’: Euro 2012 footballers: who are the most expensive players? Who are the Rising stars at Euro 2012?



E-books, free e-books, Euro 2012 e-books
 
  
 Popularity 
 Rating: 3      Rate this article   30 
 07 Apr 2012

Flashback Trojan – more info

 







So how the Flashback Trojan was able to infect such enormous amount of Macs?

It is being distributed via infected websites as a Java applet that pretends to be an update for the Adobe Flash Player. The Java applet then executes the first stage downloader that subsequently downloads and installs the main component of the Trojan. The main component is a Trojan-Downloader that continuously connects to one of its command-and-control (C&C) servers and waits for new components to download and execute.

The bot locates its C&C servers by domain names, and these names are generated using two algorithms. The first algorithm depends on the current date, and the second algorithm uses several variables that are stored in the Trojan’s body and encrypted with the computer’s hardware UUID using RC4 cipher.

We reverse engineered the first domain generation algorithm and used the current date, 06.04.2012, to generate and register a domain name, "krymbrjasnof.com". After domain registration, we were able to log requests from the bots. Since every request from the bot contains its unique hardware UUID, we were able to calculate the number of active bots. Our logs indicate that a total of 600 000+ unique bots connected to our server in less than 24 hours. They used a total of 620 000+ external IP addresses. More than 50% of the bots connected from the United States.

Geographical distribution of active Flashfake bots

We cannot confirm nor deny that all of the bots that connected to our server were running Mac OS X. The bots can be only identified by a unique variable in their User-Agent HTTP header named “id”, the rest of the User-Agent is statically controlled by the Trojan. See example below:

"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1; sv:2; id:9D66B9CD-0000-5BCF-0000-000004BD266A) Gecko/20100101 Firefox/9.0.1"

We have used passive OS fingerprinting techniques to get a rough estimation. More than 98% of incoming network packets were most likely sent from Mac OS X hosts. Although this technique is based on heuristics and can’t be completely trusted, it can be used for making order-of-magnitude estimates. So, it is very likely that most of the machines running the Flashfake bot are Macs.




Amount of infected computers by countries




Amount of infected computers by operating systems




Map shows amount of infected computers








Similar topics:

Flashback Trojan infected 600 000+ Macs

Silicone girl from Sweden

St. Petersburg girl pumped the biggest mouth in the world

Megaupload.com – the latest news

MegaUpload Founder Claims He’s ‘Evil,’ ‘Guilty,’ And ‘God’ On His License Plates

Kim Dotcom – Bio.

Megaupload - cost copyright holders at least $500 million.



Silicone injections!


  
  More similar links:

Flashback Trojan – more info

Flashback Trojan: Check If You’re Infected and What to Do About It

 
    
 Rate this article from 1 to 5 

      Comments
             
 

11.07.2012    Beyza

I apologize for that. By preososifn I am a speed reader and often what they do not teach you in those preososifnal classes is how easy you can over look important details. :) What IS funny about that is the spelling of the name Philip . I have a sa

              
        Add comment
Your name:
Your comment:
                      
 Tags: SoftFern Tutorials, malware, SoftFern Programming Tutorials, Apple, Java applet, Trojan-Downloader, Apple company, Flashback, Flashback Trojan, virus, Mac virus, Trojan, infected websites
   More iPad, Androids, Tablet PCs ...
 


  Home page Weird We sell Programming Windows
  News Our Photos Photoshop and Photography SQL server Microsoft Office
  Tech News Our Portfolio iPad Misc Web sites development
  Videos Archive Androids Graphic design Software development
  Auckland and New Zealand About Us Tablet PCs CD/DVD presentation Play games online
  Football Contact us Round the Bays 2012 photos Ocean Swim 2012 photos Auckland Events
  Sport Our Portfolio Stock Images Stock Photos Links Exchange
  Hot Girls Our clients On Twitter Add link Site Map
  Our Twitters’ gadget Site Map Google+ Site Grid Poklonskaya.info
  Health and Beauty Site Grid Pinterest Natalia Poklonskaya.info Soft Fern forums
  Misc News Web pages Facebook Photos, images Hair & Beauty
  On YouTube CD/DVD presentaton Tumblr Daily Motion Flickr
  YouTube - 2 Graphics LinkedIn Live Journal Stumble Upon
  Vimeo - videos Tutorials - Videos Tutorials - Weird Most Popular on Internet Yahts, boats, Tall Ships

SoftFern (New Zealand LTD). 
Design and development by SoftFern 2003 - 2014 Graphics supplied by BonaNZ.com