Comments for inREVERSE

Comment on Malware Analysis via Reflection by CurtW

CurtW — Sat, 21 Aug 2010 05:33:22 +0000

Hi, thanks for the post. Is the tool available? I have something I could use it for, a sample of the newest unruy. In the meanwhile, I’m going to look at JavaSnoop. I’ve learned that there are some Java options for calling the jar that will also do something of a run trace, but I need to fire up the goat first.
@curtw

Comment on About TmpHider/Stuxnet #1 by rur

rur — Tue, 17 Aug 2010 15:18:41 +0000

Thank you!

Comment on About TmpHider/Stuxnet #1 by cP

cP — Sat, 07 Aug 2010 11:26:23 +0000

You can download it from here:
http://ivanlef0u.nibbles.fr/repo/windoz/MS-SHLLINK.pdf

Comment on About TmpHider/Stuxnet #1 by swirl

swirl — Wed, 21 Jul 2010 13:27:44 +0000

we will upload it here shortly :)

Comment on About TmpHider/Stuxnet #1 by rur

rur — Wed, 21 Jul 2010 13:23:08 +0000

Hi!
Thank you for interesting research! The bad thing is microsoft removed pdf with documentation ([MS-SHLLINK].PDF) from their site :(
May be someone saved it and can upload it to sendspace or rapidshare?
Thanks

Comment on About TmpHider/Stuxnet #1 by swirl

swirl — Sun, 18 Jul 2010 22:55:26 +0000

Hey gb,

if I blur all the image there would be no point in publishing it right ? ;)
and anyway now there are already POCs out there so no harm done

Comment on About TmpHider/Stuxnet #1 by swirl

swirl — Sun, 18 Jul 2010 22:47:45 +0000

Hi Fotis,

I got it from a private feed but you can ask a copy from contagiodump

Comment on About TmpHider/Stuxnet #1 by gb

gb — Sat, 17 Jul 2010 20:02:26 +0000

Hey, it’s good that you’re analyzing and posting info on it, I recommend you blur out the whole image and not just the ascii part.

Comment on About TmpHider/Stuxnet #1 by Fotis

Fotis — Fri, 16 Jul 2010 18:50:56 +0000

Hey nice info posted there. I would be glad if you could give me some links for a sample of this worm. I am especially interested in analyzing those lnk files that trigger the exploit.

Thanks

Comment on Malware Analysis via Reflection by Sarkie

Sarkie — Fri, 09 Jul 2010 10:01:34 +0000

I used to use DJ Java for decompiling any Java malware, used to be pretty good before it went payware.

Surprised this was .net reflection! I suppose most people have out dated Java inside their browser.

Anyway, nice article.

@sarkie_dave