full-disclosure - W32.novarg.a - Highly distributed mass mailer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: W32.novarg.a - Highly distributed mass mailer

"Logan5" <Logan5@...an5.com> wrote:

> Is the programmer a Matrix fan?  ...

If so, your "discovery" would have nothing to do with it...

> ...  Found this decoding the .zip and .scr
> (sanitized for your protection):
> 
> @1A1Ch:
> Sack_i..+D.k=.smith[C.+_.m.B...h...&joe?neo/...
> 
> Funny to see both Agent Smith and Neo on the same few bytes of code :)

Those strings are in the compressed data part of a UPX-packed .EXE so 
are not really part of the worm's code.


Regards,

Nick FitzGerald