Malware Reverse Engineering
Debugging, disassembling and documenting interesting malware...
367 topics in this forum
-
W32.Duqu a.k.a. Stuxnet II
by PaperBall- 10 replies
- 8.1k views
Anyone have a copy of this new malware that was discovered last week?
-
The Exception Table hook
by STRELiTZIA- 0 replies
- 4.6k views
Using Exception Table hook to spread malicious code, paper by Peter Ferrie. http://pferrie.host22.com/papers/holey.pdf
-
Virus reverse engineering
by linuscomex- 8 replies
- 7.5k views
Hi all please help me to virus reverse engineering and find virus source code Through reverse engineering
-
.NET/MSIL Malicious Code and AV/Heuristic Engines
by CodeExplorer- 2 replies
- 6.3k views
.NET/MSIL Malicious Code and AV/Heuristic Engines />http://www.symantec.com/connect/articles/netmsil-malicious-code-and-avheuristic-engines Nice article; the only thing nice from Symantec
-
rootkit.com archive
by lr300- 1 reply
- 6.3k views
Does anyone have any archive of this great site? I've bought Subverting the Windows Kernel book but without sources from site the book is only partially useful. Please help. Thanks in advance.
-
IEEE Software Taggant System For Exposing Malware Creators...
by Teddy Rogers- 12 replies
- 8.8k views
IEEE Software Taggant System For Exposing Malware Creators Well... I have been hearing and reading about this everywhere for a while now. Numerous packer and protector developers have already been trumping this up as the bee-all for software developers who use their packer/protector products as a means to stop false positives and at the same time be used to identify/flag stolen or bogus protector licences used on files. For those who do not know (yet) if it becomes standard we may see this being common place. />http://standards.ieee.org/news/2011/icsg_software.html How practical and to what purpose it will end up serving exactly I still have doubts to. Have a read and…
-
Virus Bulletin Jully 2011
by CodeExplorer- 0 replies
- 4.2k views
Virus Bulletin Jully 2011 />http://www.sysreveal.com/uploads/vb/VBJuly2011.pdf
-
Maleware selfchecking Zeus Bot
by ltheonel- 2 replies
- 4.9k views
Since noboy is interested, thread can be deleted please. zbot.zip
-
HITB Magazines
by C0M3ND4D0R- 0 replies
- 15.6k views
A collection of (so far) 6 magazines HITB.......on malware analysis and exploiting among other issues free distribution http://magazine.hackinthebox.org/hitb-magazine.html
-
Malware Using Right to Left Override Unicode
by Sina_DiR- 6 replies
- 5.7k views
This is the new trick in Unicode string that could deceive users to open and exe file that showing pdf txt etc. It could be new way to spammers For more information check out F-Secure analyze: Redirect to F-Secure
-
- 1 reply
- 5.3k views
I downloaded stuxnet from http://tuts4you.com/download.php?view.3011. The files seem valid as I scanned the contents at virustotal. Then I inserted a flash drive and executed the dropper.exe file. According to Microsoft (http://blogs.technet.com/b/mmpc/archive/2010/07/16/the-stuxnet-sting.aspx), the dropper (TrojanDropper:Win32/StuxnetA) should drop the following into the system: Worm:Win32/Stuxnet.A Trojan:WinNT/Stuxnet.A Trojan:WinNT/Stuxnet.B (initially called VirTool:WinNT/Rootkitdrv.HK) Trojan:Win32/Stuxnet.A Worm:Win32/Stuxnet.B Although, it seemed to have triggered some components of stuxnet,(the shortcut and tmp files got hidden, so the rootkit was on its way) I a…
-
Honeynet Project Challenge 9...
by Teddy Rogers- 1 reply
- 4.5k views
Honeynet Project Challenge 9 Submissions to be submitted by September 4th 2011. https://www.honeynet.org/node/751 http://malphx.free.f...es-final.tar.gz Ted.
-
- 0 replies
- 4.4k views
A nice paper I found on the utter trash that is Sophos.... />http://lock.cmpxchg8b.com/Sophail.pdf Sophail.pdf
-
Joebox
by CodeExplorer- 2 replies
- 7.6k views
Joebox Joebox is an extensive runtime analysis system. It is designed for automatic runtime analysis of malware and other software on Windows based operating systems. Joebox executes a potential malicious program on a full Windows system and observes the behavior of the program during execution. It manages the complete analysis cycle automatically. Link: />http://www.joebox.ch/
-
How Digital Detectives Deciphered Stuxnet...
by Teddy Rogers- 2 replies
- 4.5k views
/>http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/all/1 Ted.
-
Patent application title: Heuristic detection of malicious code
by CodeExplorer- 1 reply
- 6k views
Patent application title: Heuristic detection of malicious code />http://www.faqs.org/patents/app/20090013405
-
Monthly Malware Statistics, June 2011
by News Feeder- 1 reply
- 7.8k views
The following statistics were compiled in June using data from computers running Kaspersky Lab products: 249,345,057 network attacks blocked. View the full article
-
Can i attach a c-file to a c-compiler?
by tukki_2020- 3 replies
- 6.5k views
Hey guys, i just want to brainstorm an idea so please be patient. I have made a c-program which writes all the images(rgb content) in a folder to a structure in another c-file( along with the needed code to compile and execute) and deletes the images. Now if i compile and run the new .c-file, i am able to restore these images lets say on providing a password or something. But of-course i need a c-compiler to do the compiling. So i have the question: 1.> I want to make it independent in the sense that i want the compiler to travel with the original exe file and later when needed it compiles the second c-file that contains the structure for the images. Is it possible? t…
-
How do AV systems find packed Malicious Software
by GoJonnyGo- 11 replies
- 10.1k views
Hi there, i am wondering, how antivirus systems can find viruses in packed software. Do they know every unpacking routine and first look at with with protector it is packed and unpack it then to perform a search or do they wait till the exe unpacked itself and is on oep or how does this happen?
-
BlackHole Exploit Kit 1.0.2 - Download !
by Guest zikmik- 3 replies
- 7.4k views
First Public Release of BlackHole Exploit Kit. BlackHole exploit kit is yet another in an ongoing wave of attack toolkits flooding the underground market. The kit first appeared on the crimeware market in September of 2010 and ever since then has quickly been gaining market share over its vast number of competitors. In fact, many antivirus vendors now claim that this is one of the most prevalent exploit kits used in the wild. Even Malware Domain List is showing quite a few domains infected with the BlackHole exploit kit. Black Market Cost : Users can purchase the annual license for $1500, semi-annual license for $1000, or just a quarterly license for $700. The license inc…
-
automated analysis by Comodo
by deepzero- 0 replies
- 3.9k views
just saw that Comodo offers an automated malware analysis service: http://camas.comodo.com/cgi-bin/submitwhich indeed seems to output lots of interesting information.
-
VM Detecting in malware
by Pooya- 1 reply
- 6.5k views
Hi Guys As I've been searching through this topic , I've got some interesting picture aside of VM Fingerprints.... like I/O Backdoor in VMware... but my main question is that how to find a way like VMware Method ? I've read that the more reliable technique for detecting is relying on assembly-level code that behaves differently in VM... so how can I observe this behavior ??? Any little tiny clue would be appreciated Best Regards
-
Paper: Hunting rootkits with Windbg
by frank_boldewin- 2 replies
- 7.3k views
Here are the slides to my talk "Hunting rootkits with Windbg" at the Ruhr University of Bochum yesterday. I'll introduce several ways to find well known rootkits like Rustock or TDL Versions 3+4 with Windbg and scripts. Enjoy! Paper The Windbg script shown in the slides to grab Kernelcallbacks can be found here: Windbg Script
-
Trojan-PSW.Win32.OnLineGames.eos
by Teddy Rogers- 7 replies
- 6.3k views
Win32OnlineGames.txt Ted.
-
tdl3 rootkit - source
by deepzero- 0 replies
- 5.8k views
This source of the tdl3 rootkit driver has been floating around for some time now, might be a interesting read for some people.... http://pastebin.com/he4hVjQ1
