Fighting malware and spam

AntiRE en masse

Kurt Baumgartner PC Tools

  download slides

From Autorun to Zbot, behavioural technologies ignore the most effective evasion strategies implemented in malware families' packers and protection. However, proper research and analysis cannot ignore such capabilities. This paper will explore some of the most effective and prevalent techniques, and compare antiRE across the most prevalent families of 2008 and the first half of 2009.

Peter Ferrie has compiled an impressive list of antiRE techniques, but are they used and in the wild? Are they in prevalence in 2009? If not, what is? Privileged instructions and mangled exception handlers, quirky stack modifications with returns into thread creation routines in the windows loader, spaghetti flow jmp patterns, garbage api calls with invalid parameters and a variety of methods will be fully analysed in depth. Waledac, Koobface, Sinowal, Taterf and Zbot are just a few of the families that we will dissect and compare, and we will examine evasion data surrounding each of these unfortunately effective implementations.

Quick Links

Poll

virusbtn: RT @emailsecmatters: The typical spam message has sources as diverse as the spam lunch meat: http://ht.ly/2yucd
2 hours ago

virusbtn: Can anyone write a rap about our RAP tests (http://bit.ly/255ySQ) and submit it to the Symantec competition http://bit.ly/bOJg8r
6 hours ago

Virus Bulletin

• VB100 – Windows Vista Business Edition Service Pack 2
• Apple pie order?
• Anti-unpacker tricks – part eleven
• Advanced exploit framework lab set-up
• HTML structure-based proactive phishing detection
• What’s the deal with sender authentication? Part 3