Fighting malware and spam

AntiRE en masse

Kurt Baumgartner PC Tools

  download slides

From Autorun to Zbot, behavioural technologies ignore the most effective evasion strategies implemented in malware families' packers and protection. However, proper research and analysis cannot ignore such capabilities. This paper will explore some of the most effective and prevalent techniques, and compare antiRE across the most prevalent families of 2008 and the first half of 2009.

Peter Ferrie has compiled an impressive list of antiRE techniques, but are they used and in the wild? Are they in prevalence in 2009? If not, what is? Privileged instructions and mangled exception handlers, quirky stack modifications with returns into thread creation routines in the windows loader, spaghetti flow jmp patterns, garbage api calls with invalid parameters and a variety of methods will be fully analysed in depth. Waledac, Koobface, Sinowal, Taterf and Zbot are just a few of the families that we will dissect and compare, and we will examine evasion data surrounding each of these unfortunately effective implementations.

Poll

Virus Bulletin

• Social networking meets social engineering
• Flying solo
• Geneva convention
• 7th German Anti Spam Summit 2009
• Anti-phishing landing page: turning a 404 into a teachable moment
• An update on spamming botnets: are we losing the war?
• Windows Server 2008 Standard Edition SP2 x86