Preface: In 2017, Honeypot detected that malware spread a new payload targeting 60001 TCP port. The ultimate goal is the JAWS Web Server & MVPower DVR. It turns out that there will be a Shell Command Execution vulnerability. Security expert has doubt on IoT device especially DVR which make use of TCP 60001 port.

Observation: There is an unknown malware ultimate goal to spread the remote access Trojan to IT world. Even though the authority Virus Total shows that only one vendor can correctly detect and isolate this malware (see attached picture). What’s going on?

Since there are many versions of Media Feature Pack nowadays. The fact is that the Media Feature Pack version that corresponds to your Windows OS build. So a lot of time the installer won’t copy ml.dll in place. As a result cyber criminal relies above matter to do a distribution a free copy of crafted ml.dll file on Internet for download.

After the loader has finished decrypting “svchost.dll”, the loader now has a decrypted version of Taidoor, which is a DLL. The loader then uses the API calls GetProcessHeap, GetProcAddress, and LoadLibrary to load the following DLLs, KERNEL32.dll, ADVAPI32.dll, and WS2_32.dll, which Taidoor will utilize.

Advises:
– Maintain up-to-date antivirus signatures and engines.
– Keep operating system patches up-to-date.
– Scan all software downloaded from the Internet prior to executing.