Hunting for Bugs, but Found a Worm

re: Hunting for Bugs, but Found a Worm

Dave Black — Thu, 21 Jun 2012 18:51:59 GMT

Hi Ron,

Thanks for the post. Could you please clarify your statement in #3 - "By now, I am suspicious of a rogue module".

What did you discover in #1 and #2 that would lead you to have this suspicion?

Thanks for your time.

[My suspicion was based on the following facts:

Malware authors often conceal rogue modules by removing them from the Loaded Modules list.
The debugger could not map the virtual address to any module within the Loaded
Modules list.
The page was marked as PAGE_EXECUTE_READWRITE, which means it’s a code address.

Of course I realize that virtual machines environments also store executable code on one of the heaps, so the above observations are certainly not a dead giveaway, but they are enough to start formulating theories.]

re: Hunting for Bugs, but Found a Worm

Miro — Sun, 09 Jan 2011 08:35:47 GMT

Nice article Ron, thanks for this! An for the rest of GES guys, please post more frequently! :)

re: Hunting for Bugs, but Found a Worm

Paulo Oliveira — Sat, 08 Jan 2011 14:18:29 GMT

Great stuff Ron!! Thanks for sharing!!

Regards,

Paulo Oliveira.

re: Hunting for Bugs, but Found a Worm

Bob Dobbs — Sat, 08 Jan 2011 05:48:59 GMT

That was totally intuitive. I'm so glad Microsoft Windows is easy to use.

re: Hunting for Bugs, but Found a Worm

Felix — Sat, 08 Jan 2011 02:50:28 GMT

Thanks for the post! Very interesting stuff.