lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <BAY12-F4xmDGgMrT5WZ00001bf1@hotmail.com>
From: randnut at hotmail.com (first last)
Subject: MyDoom download info

> > >IE: how do you know that the behavior you see in the lab reflects
> > >behavior in
> > >the real world? (I get a kind of 'schrodingers cat' deja vu).
> >
> > You can always disassemble the virus, which is what people
> > will do if it's a real "popular" one such as MyDoom.
>
>IIRC there are viruses that are encrypted and are almost impossible
>to disassemble?
>
>Would that be true?
>

Sobig.F was packed with tElock. It's a PE file protector. It "encrypts" the 
program's code and data, and tries to detect debuggers before giving control 
to the real program. If you don't have the right tools and skills it could 
be difficult to unpack it. IIRC, it took the anti-virus companies two days 
to successfully unpack the program. All they really needed to do was dump it 
from memory while it was running and they could've analyzed it immediately 
with any disassembler.

_________________________________________________________________
High-speed users—be more efficient online with the new MSN Premium Internet 
Software. http://join.msn.com/?pgmarket=en-us&page=byoa/prem&ST=1


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ