ESET Research: Dino, the new spy malware
ESET today released an analytical study titled “Dino – the latest spying malware from an allegedly French espionage group analysed.” According to ESET’s research, further evidence has been found suggesting that this technically complex backdoor Trojan, which has been used for espionage purposes, was coded by French speakers.
Created by the notorious Animal Farm espionage group – the team behind the sophisticated Casper, Bunny and Babar malware attacks. “Dino is essentially an elaborate backdoor Trojan, built with a modern architecture,” explains Joan Calvet, Malware Researcher at ESET, who analyzed the malware.
"Among the many technical innovations, there is a custom file system used to secretly execute commands, as well as a complex task scheduling unit that works in a similar way to the Unix 'cron' command."
ESET's research also records the commands accepted by the Dino binary, along with the names chosen by the malware's creators.
The “search” command proved to be particularly interesting, as it allows operators to search for files with meticulous precision.
For example, the malware operator can search for infected systems, specifying the file type, file size, and date range when it was last modified.
Calvet also discovered two additional clues that suggest the developers behind Animal Farm are French-speaking. "The wording in the extensive error messages raised our suspicions," Calvet continues.
"This fact, combined with the language codes specified by the author, provides further evidence that the malware's creators are indeed French-speaking.".
Of course, it's possible they deliberately misled us, but I suspect the Animal Farm team forgot to adjust the language codes in Dino."
For more information, you can visit ESET's detailed research on Backdoor Trojan Dino (Malware) at the link below
"Dino – the latest spying malware from an allegedly French espionage group analyzed" on WeLiveSecurity.com.
Source: iguru
