[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-292398-105":59,"doc-detail-292398-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","the-evolution-of-tdl-revision-1-malware-analysis","The Evolution of TDL - Revision 1 - malware analysis","","A technical malware analysis document detailing the evolution of TDL, including investigation findings, installation and infection flows across x86 and x64, and the dropper’s payload behavior. It describes the bot’s components and configuration artifacts, command and control communications, tasking and clicker mechanisms, and network hooking. The report further covers kernel-mode functionality such as self-defense, hidden file system maintenance with encrypted storage, payload injection into processes, and bootkit behavior including BIOS/OS boot stages and driver-signature check bypass.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/the-evolution-of-tdl-revision-1-malware-analysis/292398/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/the-evolution-of-tdl-revision-1-malware-analysis/292398.png","ImageObject",300,407,{"name":92,"@type":93},"Ben ","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-11-04","2026-09-17",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",17,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"What does the document cover about TDL’s evolution?","Question",{"text":113,"@type":114},"It covers investigation, installation/infection for x86 and x64, the bot architecture and configuration, kernel-mode components, and bootkit functionality across boot stages and defenses.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"How does the report describe TDL installation and infection?",{"text":118,"@type":114},"It outlines how the dropper’s payload is used, separates infection paths for x86 and x64 systems, and explains what the installation sequence leads to.",{"name":120,"@type":111,"acceptedAnswer":121},"What kernel-mode capabilities and protections are discussed?",{"text":122,"@type":114},"The document discusses self-defense, kernel-mode hooks and trace cleanup, maintaining a hidden and encrypted file system, and injecting payloads into processes, including comparisons to earlier TDL versions.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},292398,1789650940,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":140,"language":141,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":142,"faqs":143,"seo_title":144,"seo_description":67,"update_tm":130,"read_time":145,"preview_page_count":4},2336478951081,"https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c","The Evolution of TDL: Conquering x64 Revision 1.1  \nEugene Rodionov, Malware Researcher  \nAleksandr Matrosov, Senior Malware Researcher  \nCONTENTS  \nINTRODUCTION .....................................................................................................................................................4  \n1 INVESTIGATION ............................................................................................................................................. 5  \n1.1 GANGSTABUCKS ...............................................................................................................................................6  \n2 INSTALLATION ............................................................................................................................................. 11  \n2.1 INFECTING X86 SYSTEMS .................................................................................................................................. 11  \n2.2 INFECTING X64 SYSTEMS .................................................................................................................................. 13  \n2.3 THE DROPPER’S PAYLOAD ................................................................................................................................ 14  \n2.4 COMPARISON WITH TDL3/TDL3+ ..................................................................................................................... 15  \n3 THE BOT ...................................................................................................................................................... 16  \n3.1 CFG. INI ......................................................................................................................................................... 16  \n3.2 CMD. DLL ....................................................................................................................................................... 16  \n3.2.1 Network communication ....................................................................................................................... 17  \n3.2.2 Communication with command servers ................................................................................................ 18  \n3.2.3 Tasks ...................................................................................................................................................... 20  \n3.2.4 The Clicker .............................................................................................................................................. 21  \n3.2.5 Hooking mswsock.dll ............................................................................................................................. 22  \n3.3 CMD64.DLL ...................................................................................................................................................23  \n3.4 KAD. DLL ........................................................................................................................................................ 23  \n3.4.1 Kad-protocol ..........................................................................................................................................24  \n3.4.2 Configuration file ...................................................................................................................................25  \n3.5 TDL4 TRACKER ..............................................................................................................................................26  \n4 KERNEL-MODE COMPONENTS ..................................................................................................................... 27  \n4.1 SELF-DEFENSE ................................................................................................................................................27  \n4.1.1 Kernel-mode hooks ......................................................................................................","cbCaioNyLllSNy4T","https://ap.wps.com/l/cbCaioNyLllSNy4T","pdf",2500972,54,"English","# Introduction\n# Investigation\n## Gangstabuсks\n# Installation\n## Infecting x86 systems\n## Infecting x64 systems\n## The dropper’s payload\n## Comparison with TDL3/TDL3+\n# The bot\n## CFG. ini\n## CMD. dll\n## CMD64.dll\n## KAD. dll\n## TDL4 tracker\n# Kernel-mode components\n## Self-defense\n## Maintaining the hidden file system\n## Injecting payload into processes\n## Comparison with TDL3/TDL3+\n# Bootkit functionality\n## Booting BIOS firmware\n## Bypassing kernel-mode driver signature check","[{\"question\":\"What does the document cover about TDL’s evolution?\",\"answer\":\"It covers investigation, installation/infection for x86 and x64, the bot architecture and configuration, kernel-mode components, and bootkit functionality across boot stages and defenses.\"},{\"question\":\"How does the report describe TDL installation and infection?\",\"answer\":\"It outlines how the dropper’s payload is used, separates infection paths for x86 and x64 systems, and explains what the installation sequence leads to.\"},{\"question\":\"What kernel-mode capabilities and protections are discussed?\",\"answer\":\"The document discusses self-defense, kernel-mode hooks and trace cleanup, maintaining a hidden and encrypted file system, and injecting payloads into processes, including comparisons to earlier TDL versions.\"}]","The Evolution of TDL - Revision 1 - malware analysis | PDF",136]