Tag Archives: backdoor

Backdoor.ADDNEW (DarkDDoser) and Gh0st, a match made in heaven?

| By | Advanced Malware

At FireEye we monitor all kinds of attacks: targeted, non-targeted, and everything in between. We always try to figure out, not just how a piece of malicious code works, but also other possibilities, like whether it is related to some other malware, in what way, etc.

Gh0st has been much talked about and there is a lot of good research out there on this RAT (Remote Access Trojan). This RAT has been used in many serious attacks and a quick Google search on the Gh0st RAT will give you a lot of good articles which will go into great detail about the versions and the inner workings of the malware. However this post is not about Gh0st. Very recently while investigating some of these Gh0st infections, we identified another interesting piece of malware.

The Story Behind Backdoor.LV

| By | Botnets

From May of this year, we have seen a sudden uptick in the number of samples of an interesting malware we call Backdoor.LV. We have seen this malware primarily using websites hosting .exes to propagate. The HTTP header below shows one such example from which the malware was downloaded. A quick look up on the location of the IP in the HTTP header "94.129.29.233" shows that the IP is located in Kuwait.

Continue reading »