W32/stormworm.gen1 Network Analysis

[Loki]

Another paper from the guys at offensive computing

This paper briefly details the analysis of W32/StormWorm.gen1. Analysis includes the two files created by the variant and a look into the contents of those files. A quick overview of the network traffic generated by the worm is displayed and the data exchanged between the peers who are connected to the Overnet P2P network. Towards the end of the paper, extended research discusses the disassembly of the variant and where the process injection is found within the assembly code.

http://www.offensivecomputing.net/?q=node/678

PDF direct link : http://www.offensivecomputing.net/papers/j...m-3-23-2008.pdf

[Unbekannt1]

"A more in depth look into the functions and payload of the worm can be seen in Danny Quist

[Loki]

Yup, linked to that one in the topic below this one