[EP_X0FF]

Payload is the new version of Alureon routers stuff.

What exactly this stuff doing?

http://www.kernelmode.info/forum/viewto ... 3274#p3274

http://www.securelist.com/en/blog/337/T ... nerability

can someone plz share a tdl4 sample using the stuxnet task sched 0day used for privilege escalation?

http://www.kernelmode.info/forum/viewto ... 3862#p3862

[4r0]

hi! does attached sample use this vulnerability? http://www.securelist.com/en/blog/337/T ... nerability

[EP_X0FF]

No. It is old Alureon dropper related to routers DNS hijacking.
http://www.virustotal.com/file-scan/rep ... 1292186977

[EP_X0FF]

This thread created from TDL4 rootkit thread. It include information and discussion about TDSS/Alureon.EC bot responsible for DNS hijacking.