Cidox

Analysis

The Cidox botnet targets the Windows platform.

The malware is injected into running processes such as explorer.exe, svchost.exe, and chrome.exe. It hooks several functions within the injected process for redirecting to unwanted links.

This bot also gathers the basic information from the infected machine and communicates with its C&C server.

Instructions

• Make sure that your FortiGate/FortiClient system is using the latest AV database.
• Quarantine/delete files that are detected and replace infected files with clean backup copies.