Kraken Reverts to HTTP
Tuesday, April 22nd, 2008Following a friendly heads up from someone yesterday morning, I re-loaded the following Kraken samples into my honeypot: 1d51463150db06bc098fef335bc64971 65b958bf6f5eddca3d9455354af08b6f 6ec7d67d5553cbec2a99c7fbe385a729 7ecef2f126e66e7270afa7b803f715bc 8fd8c67103ec073d9303a7fbc702f89a and began monitoring them. Each sample proceeded to update itself; the updated binary is around 160KB, given a random name and placed in the system32 directory, and no longer has an imagefile icon. The names/MD5 values of ...

