InfoSec Resources

White Papers Home | What's New | Popular | Advanced Search



Malware

Student White Papers
As part of many InfoSec Institute classes, students perform a practical exam that includes researching a particular topic and writing an in-depth analysis. Along with earning an IACRB certification, we publish the best student papers here, to acknowledge the outstanding work InfoSec students are completing.
 
<< Prev Page Pages: 1 2 [3]
 Reverse Engineering Windows-based worm (scrgrd.exe) - Malware Practical #1252
Name: Jason Swallows
Windows-based worm that: ◦ Opens a port on 113 and spoofs identd for IRC connections. ◦ Connects to an IRC server, joins a channel and waits for commands from the author. ◦ Commands give broad control of the machine to the author ◦ Can steal keys for many games. ◦ Can spread by exploiting network shares with weak passwords (uses a list of common user names and passwords).
Rating: [0.00] Votes: [0]

 Reverse Engineering WINLIBUPDATE.EXE Malware
Name: Cory Adams
Malware.exe initially calls the function GetSystemDirectory to find the system directory. Next, it calls GetModuleFileName to find what it is currently named and what directory it is running from. It then does a string compare against the results of what it is currently running as to see if it is running as INLIBUPDATE.EXE. If it is not running as WINLIBUPDATE.EXE it will copy itself to the %SYSTEM% directory with the name of WINLIBUPDATE.EXE. It sets the memory @00403FB2. It then creates the process %SYSTEM%WINLIBUPDATE.EXE to run the malware it just copied/created.
Rating: [0.00] Votes: [0]

 winlogin trojan reverse engineering
Name: Joseph Terranova
• General function and functionality of the malware: o Unpacks a DLL and copies it to the system directory; the DLL is a Winlogon Notification Package. o The DLL is registered with Winlogon through the registry. • Behavioral patterns of malware: cycles indefinitely, downloading commands or code from a server. • Local system interaction: o uses multiple threads and event objects o uses mutexes to detect multiple running copies of itself o creates batch scripts to remove traces of original malware files o creates registry keys o downloads files
Rating: [0.00] Votes: [0]

<< Prev Page Pages: 1 2 [3]

© 2010 InfosecInstitute All Rights Reserved.