Questions tagged [malware]

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

Definition

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems. It can appear in the form of code, scripts, active content, and other software. Malware is the term used to refer to a number of categories of malicious or questionable software such as:

  • computer viruses
  • ransomware
  • worms
  • trojan horses (also rogue "security" software)
  • rootkits
  • keyloggers
  • dialers
  • spyware, adware, potentially unwanted software (aka grayware)
  • bots in botnets

Malware has caused the rise in use of protective software types such as anti virus, anti-malware, and firewalls. Each of these are commonly used by personal users and corporate networks in order to stop the unauthorized access by other computer users, as well as the automated spread of malicious scripts and software.

Frequently Asked Questions

329 questions
132
votes
14 answers

Where can I, as an individual, get malware samples to analyze?

It seems that a popular use of software reverse engineering skills is to reverse malicious code in an effort to build better protection for users. The bottleneck here for people aspiring to break into the security industry through this path seems to…
mrduclaw
  • 4,066
  • 8
  • 27
  • 40
15
votes
3 answers

How do AV vendors create signatures for polymorphic viruses?

I was working on a hobby AV project using ClamAV's engine. While ClamAV is a good open source engine, it has poor support for detecting polymorphic viruses. The latest updated version failed to detect many instances of Virut and Sality. How do…
shebaw
  • 685
  • 6
  • 13
10
votes
3 answers

Academic journals for latest RE/Malware/Exploitation research?

I am looking for journals to keep track of the latest advances in reverse engineering, binary analysis, malware, binary exploitation, etc.
Chase Kanipe
  • 131
  • 4
9
votes
3 answers

How to get virus body of Polymorphic Malware

I want to decrypt polymorphic malware and want to get actual virus body which is going to do infection. I tried to decrypt virut.ce (this is one polymorphic malware) in ollyDbg but it is using anti debugging and anti emulation technique and so it is…
user1744108
  • 161
  • 6
6
votes
4 answers

How antiviruses name malwares

While analyzing a binary online through the virustotal service , I found out that different AVs named the binaries differently.For instance, for that same binary Norman named it Obfuscated_A, Symantec named it WS.Reputation.1 and another AV named…
viv
  • 784
  • 1
  • 4
  • 17
5
votes
2 answers

How can we determine that malware are related?

I am curious to know about how researchers can know when different malware are related. for example: Stuxnet, Flame or Duqu, are told to be written by the same group. Does anyone know how they figure that out? I read some articles but they weren't…
user4387
  • 51
  • 1
5
votes
1 answer

How 10 IS HEX 5 bytes?

I am stuck in this video. Please solve this issue. This video is about Encryption and Decryption using Win32 API. https://www.youtube.com/watch?v=OQuRwpUTBpQ In this video 27:07 it's saying "10 IS HEX 5 bytes?" But how? Please watch this video to…
5
votes
1 answer

Intro to reverse engineering

I would like learn how to reverse engineer malwares. I have a very small experience reverse engineering windows applications. I would like to know if there are good resources that is helpful in learning this.
Ray
  • 93
  • 6
5
votes
1 answer

How can you explore behavior in malware that is not being performed?

I have a malware sample that I know is acting as a bot and connects to a botnet. The problem is that it uses no known protocol that I am familiar with (it's IRC-like) and doesn't actually do anything until it is issued commands. How can I explore…
Jeremy
  • 51
  • 1
4
votes
2 answers

Analysing malware in a real environment (non-virtual environment)

I have analysed malware previously using Cuckoo Sandbox, however, I've seen that some malware won't run as they detect they are actually running in a virtual environment (they implement some anti-virtualisation techniques). So what I was thinking is…
Ophilia
  • 187
  • 7
3
votes
1 answer

Reverse Engineering Dynamic Malware Imports?

How is it possible to reverse engineer dynamic malware imports using a debugger like x32dbg or Ollydbg? I want to dump process injection malware using a debugger trick using a breakpoint on write process memory. But I can't find any…
3
votes
1 answer

What Honeypots are recommended to capture malwares (for analysis)?

I want to operate honeypots for malware analysis purpose and packet capture. What honeypots are recommended for beginners ? And, what is the best to set-up an honeypot, should it be in a real machine or in a virtual machine ? Finally, does this…
hucuhy
  • 133
  • 3
3
votes
1 answer

Detailed description of malware content

I have just started my journey into the vast and intersting field of malware analysis. I would like to know if there is any website/book or another resource that explains what a particular block of assembly code does. A detailed description of the…
Ray
  • 93
  • 6
3
votes
1 answer

What location is this and what does it signify - "d:\w7rtm\minkernel\ntdll\ldrinit.c"

Came across this while debugging a exe. Cant find much on it anywhere so thought I'll put it up here. Any ideas as to what this could be used for? CPU Disasm Address Hex dump Command Comments 77887F10 . …
Chuck Nurit
  • 63
  • 1
  • 7
2
votes
1 answer

Is data exfiltration possible without obvious system calls?

http://resources.infosecinstitute.com/data-exfiltration-techniques/ I am teaching myself to identify exfiltration of sensitive data with malicious binaries. One thing I have noticed, is in most examples a rather easy spot system call to some sort…
MrSynAckSter
  • 1,258
  • 1
  • 10
  • 24
1
2 3