AlienVaults: more nicely-done analysis…

…this time linking the encryption routines used in C&C communication by the malware they first reported last week to a Linux backdoor that they believe to have been around since 1999 or earlier.  

VirusTotal analysis/info here.

This is a different issue to the serving of the OSX Lamadai dropper to Linux clients, as reported by ESET. That dropper can’t actually infect a Linux system.

 Mac and I weren’t particularly aware of AlienVault Labs until recently. It’s good to see them doing such cool analysis and trading information with the mainstream AV industry. 🙂

David Harley CITP FBCS CISSP