Reversing worm

[~karthikeyanck~]

Hi All

I'm not sure if these kind-a requests are welcome'd.

Am trying to reverse a worm and having troubles in doing it. I found that the worm is packed using autoit. Please can somebody assist me in reversing it. Let me know if you need the source.

I understood the behavior of the worm, but trying to dig deep into the code to understand things better.

Thanks for your assistance in advance,

Note: I've already tried using autoit decompiler with no luck. It doesn't identify the executable

[~karthikeyanck~]

Hi All

I'm not sure if these kind-a requests are welcome'd.

Am trying to reverse a worm and having troubles in doing it. I found that the worm is packed using autoit. Please can somebody assist me in reversing it. Let me know if you need the source.

I understood the behavior of the worm, but trying to dig deep into the code to understand things better.

Thanks for your assistance in advance,

Note: I've already tried using autoit decompiler with no luck. It doesn't identify the executable

got the worm attached, password - infected.

This worm usually spreads from one machine to another via shared drives (open to everyone) and via external storage mediums (with the help of autorun.inf file). Drops the same file to %systemdirectory% and starts on startup using the registry key (RUN). Connects to couple of remote web sites to download additional malwares (port 88 GET ******.gif file).. deletes the source using suicide.bat file that was dropped in %temp% directory... This is what I know of this worm, but can somebody reverse this, I think it is obfuscated Autoit packed.

*Edit*

Checks the availability of a debugger - "IsDebugger" present

csrcs.zip

Edited August 24, 2009 by ~karthikeyanck~

[~karthikeyanck~]

Hi All

I'm not sure if these kind-a requests are welcome'd.

Am trying to reverse a worm and having troubles in doing it. I found that the worm is packed using autoit. Please can somebody assist me in reversing it. Let me know if you need the source.

I understood the behavior of the worm, but trying to dig deep into the code to understand things better.

Thanks for your assistance in advance,

Note: I've already tried using autoit decompiler with no luck. It doesn't identify the executable

got the worm attached, password - infected.

This worm usually spreads from one machine to another via shared drives (open to everyone) and via external storage mediums (with the help of autorun.inf file). Drops the same file to %systemdirectory% and starts on startup using the registry key (RUN). Connects to couple of remote web sites to download additional malwares (port 88 GET ******.gif file).. deletes the source using suicide.bat file that was dropped in %temp% directory... This is what I know of this worm, but can somebody reverse this, I think it is obfuscated Autoit packed.

*Edit*

Checks the availability of a debugger - "IsDebugger" present

I'm trying to find the OEP of the exe, can somebody shed some light