full-disclosure - Microsoft Update Loader msrtwd.exe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040902063007.GA635@localghost.muenther.de>
From: jan.muenther at nruns.com (Jan Muenther)
Subject: Microsoft Update Loader msrtwd.exe

> google came back with a forum to do with sdbot; however, the file was
> listed as "Morphine".

Morphine is not a virus or malware in itself, it's a tool for PE binary en-
cryption, self-decrypting on execution. It actually places the whole 
source image into the .data section of a newly produced file. 
Basically, this should hinder your virus scanner from recognizing what this 
binary really is, since it only matches on the pattern for the Morphine engine
itself. 

See http://rootkit.host.sk

Regards,

J.