Malware Reverse Engineering
Debugging, disassembling and documenting interesting malware...
360 topics in this forum
-
The evil genius of XP Antivirus 2008
by CodeExplorer- 6 replies
- 4.6k views
Link: http://www.theregister.co.uk/2008/08/22/an...hack/print.html Here is the hole description of what XP Antivirus 2008 does. Stay away from this malware scam.
-
AutoIt script
by Bleed- 0 replies
- 10.2k views
I tried to play with one virus that a friend gave to me. well I discovered that it was an autoit script. What it does: creates a .bat file that has a shutdown command. creates an autorun.inf on all drives replicates itself on all drives I plan to reverse with little patches it and make it delete all that it created but I have no idea on what API it uses to create those stuff. Can someone tell me (or just pointers) on where to start or what to look for. thanks...
-
Activities regarding malwares
by CodeExplorer- 0 replies
- 4.6k views
A blog about activities, products and ideas regarding malwares: http://sunbeltblog.blogspot.com/2007_12_01_archive.html Criminals try to 'copyright' malware: http://www.msnbc.msn.com/id/24394270/ Conficker Malware to Return April 1: http://itmanagement.earthweb.com/secu/arti...urn-April-1.htm Websense: Cybercriminals Imitating Social Networks To Spread Malware: http://www.darkreading.com/security/client...client+security
-
Your Guide to Understanding Malware
by CodeExplorer- 0 replies
- 3.7k views
Link: http://laptoplogic.com/resources/your-guid...tanding-malware May 17, 2009 at 07:05:34 AM, by Gilberto J. Perera Learn what separates viruses from worms, bots from Trojans and other nasty creatures in Gilberto J. Perera's guide to malware.
-
- 1 reply
- 4.9k views
Link: http://www.kishorethakur.com/2008/12/advan...-forensics.html Here are a few quick steps for performing malware analysis on various badware (viruses, works, trojans, rootkits) that you may find in the course of a computer forensics investigation. In this case, I'm analyzing a variant of Sohanad, a Instant Messaging Worm, also known as "the cool pics worm".
-
First virus in 2 years...
by aztecx- 3 replies
- 4.2k views
I believe there may have been 3 viruses that were attached to the infected file I executed but here are samples of two of them. One is a dump while the other is just the original file that was copied into the temp folder at execution. Anyways I've attached a rar file with the two infected files. Anyone that collects malware enjoy. Anyways as I'm still in the process of trying to remove it so hopefully I don't run into any big difficulties. PASS - aztecx Malware.rar
-
ConF(u)cker
by Willi000- 6 replies
- 6.5k views
http://mtc.sri.com/Conficker/ http://blog.fortinet.com/the-art-of-unpack...conficker-worm/
-
Am I infected?
by Victor- 7 replies
- 6.9k views
Any more information needed just ask. Thanks in advance.
-
- 1 reply
- 4.3k views
Something I found last week - can't remember where from though How_Conficker_makes_use_of_MS08_067.pdf
-
ViSA_Coding_By_Mr.ViRuSHaCkEr.exe
by high6- 3 replies
- 4.6k views
Getting into virus analyzes(anyone have any recommendation for articles?). Right now I am doing it on my pc . Really need to setup a VM . Although Comodo is doing nicely against small viruses. Anyone know anything about this one? (DO NOT DOWNLOAD IF YOU DO NOT KNOW WHAT YOU ARE DOING) http://rapidshare.com/files/220676862/ViSA...ViRuSHaCkEr.exe
-
SimbiOZ, is that a malware
by movzxEax- 7 replies
- 4.7k views
This's un unpackme from the unpackmes collection uploaded on tuts4you server It has a very strange behavior, it replaces the svchost.exe sercive + tries to scan all opened processes + tries to change the page protection of some places in these processes After each run, It crashes all opened apps (even kaspersky AV + Outpost firewall + explorer olso ...) all processes are closed It's very strange I first lunched it under vista no sp -> crashes all and then I tried to figure out what happened (but leak of time) and can't go further now Please if someone has some extra time and can analyse this unpackme, it will be a great help thank you. BE CAREFULL, DON'T RUN IT OUT OF…
-
- 5 replies
- 5.2k views
Hi, I've released Backdoor.Win32.UltimateDefender.gtz Reverse Engineering: http://evilcry.netsons.org/tuts/Mw/Backdoo...ateDefender.pdf Regards, Giuseppe 'Evilcry' Bonfa'
-
PaiN RAT v0.1 RC1 Portable
by unbanhub- 4 replies
- 8.2k views
Hy, recently i`ve search on the internet for an PaiN RAT Portable and I found the last version of the producer, and I`m happly to share this with you. PaiN RAT v0.1 RC1 Portable I`ve scan on Novirusthanks.com to check it, here is the log. File Info Report generated: 17.2.2009 at 20.33.00 (GMT 1) Filename: PaiN RAT.exe File size: 1,331 KB MD5 Hash: 8DD76D109D233BCF8BA8216959937067 SHA1 Hash: 7A1138F999E50238A3C2B8D2073F8EBCADD90B79 Packer detected: Nothing found Self-Extract Archive: Nothing found Binder Detector: Nothing found Detection rate: 4 on 23 Detections a-squared - Trojan-Downloader.Win32.Delf.CQ!IK Avira AntiVir - Nothing found! Avast - Nothing…
-
- 5 replies
- 5.1k views
I posted some information regarding this project in my blog here on tuts4you. I thought I would share it here as well to hopefully gain some support. The main goal of this project is to improve the quality of scanning techniques used in anti-virus software. The issue I have is that there are not methods of "detecting the usage of strong cryptography, secure key management, and obfuscation that can be used inside malware. I have a lot of love for the researchers and I know they work extremely hard and are very talented. The issue I have is that there is a lot of room for improvement and I would like to see that improvement made. We need stronger methods of attacking crypto…
-
How to Analyze a BHO?
by pichoo- 3 replies
- 4.7k views
Can anyone point me to any resource that talks about analyzing an Internet Explorer Browser Helper Object? I am semi competent in analyzing typical executables, however I don't really know where to start with a BHO dll other than looking at the strings, since it doesn't look like it executes like an exe. Any help would be appreciated, I'm really just looking for a starting point.
-
Anti-Virus Coding Requirement
by maxil122- 8 replies
- 5.5k views
Hello, Please, can someone help me to know what is required to made an Anti-virus: - Which language is more efficient ? - What's required like Windows Internals / Coding in low level / Good know in x86 family / File systems (PE) / Reversing / Unpacking... ? It will be helpful if you make it clear. Thanks.
-
Help Unpacking
by pichoo- 4 replies
- 11k views
Hi, can anyone help me to figure out what this malware is packed with. PeID does not identify it, and VirusTotal gives these results from F-Prot and Authentium: packers (F-Prot): PE-Armor, Malware_Prot.V packers (Authentium): PE-Armor, Malware_Prot.V I've attached the file in a password protected Rar, password is "password". Any help would be appreciated. Thank you Also, I'm new to these forums, so if I'm breaking any rules, please let me know. malware.rar
-
- 8 replies
- 16.2k views
get the whole exploit code here: http://www.milw0rm.com/exploits/6031 i think this exploit is dangerous. maybe some software will use it to avoid debugging? or probably malware will use it. keep your eyes open
-
Strange file was sent, help analyzing.
by carb0n- 2 replies
- 4.3k views
There was a file sent from my email that I didn't authorize, me and my staff have been analyzing but haven't come u with a lot of stuff, here is what we got so far: johnnyk analyzed the crypter drops this smss.exe into windows directory hers some reports http://anubis.iseclab.org/?action=result&a...amp;format=html http://research.sunbelt-software.com/ViewM...aspx?id=6585843 http://www.novirusthanks.org/analisis/39b5...18cba37b757e2b4 plus it dorps this crypter.exe and this txt file saying Your files zip,rar,doc,txt,xls,ppt,vbs,htm,html,pas,bas,c,cpp,exe were encrypted . Send mail to unknowncrypter@mail.ru for unencryption key. Your …
-
Mu_hr00M_CryT0r_V1.0
by Teddy Rogers- 0 replies
- 3.8k views
I came across this some months back but only taken a look at it now. Strange thing is after running the crypter everytime I now go in to the directory, "Mu_hr00M_CryT0r_V1.0" it crashes and reboots the OS. Same thing for the filename... http://rapidshare.com/files/142314333/Mu_h...r_V1.0.zip.html Ted.
-
Is this Malicious?
by Blah- 5 replies
- 5k views
hey all.. i want to try this app out but when clicking the setup exe zone alarm says its malicious but not sure if its true since the source is right from the web page heres the homepage http://www.pitchtrain.com/ exe http://www.pitchtrain.com/PTsetup.exe thanx mates...
-
Trojan.Zhelatin.Pk Reverse Engineering
by evilcry- 4 replies
- 5.1k views
Hi, I've released a paper on Trojan.Zhelatin.pk RCE Analysis, that can be downloaded here: http://evilcry.netsons.org/tuts/Mw/Zhelatin.pdf Have a nice read.. Regards, Giuseppe 'Evilcry' Bonfa'
-
Rustock C The Beast
by evilcry- 16 replies
- 9.5k views
Hi, Rustock C is definitely the most powerful advanced rootkit for Windows ever seen, the Pure Evil Here some papers about it http://info.drweb.com/show/3342/en http://www.rootkit.com/newsread.php?newsid=879 http://blog.threatexpert.com/2008/05/rusto...ested-doll.html http://blog.threatexpert.com/2008/06/new-r...to-hotmail.html
-
Tracking Gimmiv...
by Teddy Rogers- 0 replies
- 12.7k views
Research_Blog___Research___SecureWorks.pdf http://www.secureworks.com/research/blog/i...racking-gimmiv/ Ted.
-
BIG VIRUS COMING
by Ac- 6 replies
- 8.2k views
VERY IMPORTANT - BIG VIRUS COMING !!! PLEASE READ http://www.snopes.com/computer/virus/postcard.asp Hi All, I checked with Norton Anti-Virus, and they are gearing up for this virus! I checked Snopes (URL above:), and it is for real!! Get this E-mail message sent around to your contacts ASAP. You should be alert during the next few days. Do not open any message with an attachme nt entitled 'POSTCARD FROM HALLMARK,' regardless of who sent it to you. It is a virus which opens A POSTCARD IMAGE, which 'burns' the whole hard disc C of your computer. This virus will be received from someone who has y…
