{"id":74740,"date":"2012-08-20T16:03:51","date_gmt":"2012-08-20T10:33:51","guid":{"rendered":"https:\/\/blogs.quickheal.com\/?p=74740"},"modified":"2012-08-20T16:03:51","modified_gmt":"2012-08-20T10:33:51","slug":"gauss-malware-updated-version-of-stuxnet","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/gauss-malware-updated-version-of-stuxnet\/","title":{"rendered":"Gauss Malware &#8211; Updated version of Stuxnet"},"content":{"rendered":"<p>Gauss is a highly complex and sophisticated online banking malware that belongs to the same family as Flame, Duqu and Stuxnet. Gauss seems to be updated version of Stuxnet malware. Similar characteristics of these malwares are as follows:<\/p>\n<ul>\n<li>Use encryption method (XOR)<\/li>\n<li>Command and control (C&amp;C) servers<\/li>\n<li>Use .LNK exploit vulnerability<\/li>\n<li>Use USB as storage medium for stolen data<\/li>\n<li>Formulated to steal browser cookies<\/li>\n<\/ul>\n<p>The primary focus of Gauss is to steal browser passwords, online banking account credentials and machine information of infected systems. Gauss infects 32-bit Windows machines, but it also contains a separate module for USB drives that can collect information from 64-bit Windows systems as well. Gauss has the ability to infect USB thumb drives with a data-stealing component that exploits the same .LNK vulnerability that was targeted by Stuxnet and Flame. Gauss is also capable of disinfecting the drive under certain circumstances and uses removable media to store collected information in a cleverly hidden file.<\/p>\n<p>Additionally,\u00a0Gauss also installs a font called &#8216;Palida Narrow&#8217;. This font file does not contain any malicious code. However, it can be used as a marker. This means that an attacker can remotely check if a system is infected by checking to see if this font is installed.\u00a0Gauss uses several other plugins to collect information from the infected computer.<\/p>\n<p>After execution it drops these following files:<\/p>\n<ul>\n<li>System32devwiz.ocx<\/li>\n<li>System32dskapi.ocx<\/li>\n<li>System32lanhlp32.ocx<\/li>\n<li>System32mcdmn.ocx<\/li>\n<li>System32smdk.ocx<\/li>\n<li>System32windig.ocx<\/li>\n<li>System32winshell.ocx<\/li>\n<li>Windowsfontspldnrfn.ttf<\/li>\n<\/ul>\n<p>It modifies\/creates the following registry entries:<\/p>\n<p><em>HKLMSoftwareMicrosoftWindows NTCurrentVersionFonts<\/em><br \/>\n<em>Palida Narrow (TrueType) = pldnrfn.ttf<\/em><\/p>\n<p><a href=\"https:\/\/www.quickheal.com\/\">Quick Heal<\/a>\u00a0successfully\u00a0detects\u00a0the files related to the Gauss malware. It is also recommended to keep your Operating\u00a0System\u00a0updated\u00a0and to apply all the\u00a0necessary\u00a0security\u00a0patches\u00a0provided\u00a0by Microsoft.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Gauss is a highly complex and sophisticated online banking malware that belongs to the same family as Flame, Duqu and Stuxnet. Gauss seems to be updated version of Stuxnet malware. Similar characteristics of these malwares are as follows: Use encryption method (XOR) Command and control (C&amp;C) servers Use .LNK exploit vulnerability Use USB as storage [&hellip;]<\/p>\n","protected":false},"author":22,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[164,24,4,36],"tags":[195,138,49,47,37,169,139,38],"class_list":["post-74740","post","type-post","status-publish","format-standard","hentry","category-cyber-crime","category-malware","category-news","category-security-patch","tag-duqu","tag-flamer","tag-malware","tag-security","tag-security-update","tag-spyware","tag-stuxnet","tag-vulnerability"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/74740"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/22"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=74740"}],"version-history":[{"count":0,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/74740\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=74740"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=74740"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=74740"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}