EP_X0FF wrote:Not everything with ZeroAccess string is ZeroAccess malware and not every ZeroAccess malware has ZeroAccess string inside.True, but the certificate was back to normal after formatting the machine .... Thanks for your input, as always.
A forum for reverse engineering, OS internals and malware analysis
3. If everything fine it additional memory pages in Explorer.exe memory and maps another shellcode here, causing "n" to be loaded inside Explorer.exe. "n" includes "desktop.ini" component inside as raw data.You mean "services.exe" instead, right?
Tigzy wrote:No I mean shellcode with LdrLoadDll AFAIR in the context of Explorer.exe3. If everything fine it additional memory pages in Explorer.exe memory and maps another shellcode here, causing "n" to be loaded inside Explorer.exe. "n" includes "desktop.ini" component inside as raw data.You mean "services.exe" instead, right?
Take decrypted sirefef dropper and try yourself. Set breakpoints on NtAllocateVirtualMemory, NtWriteVirtualMemory.
Attachments
pass: malware
(117.69 KiB) Downloaded 67 times
(117.69 KiB) Downloaded 67 times
Ring0 - the source of inspiration
Here is the 3rd services.exe MD5 I know of attached
Quads
Quads
Attachments
password = infected
(128.29 KiB) Downloaded 65 times
(128.29 KiB) Downloaded 65 times
Quads wrote:Here is the 3rd services.exe MD5 I know of attached
Quads
The x86 version of services.exe, this means infection is cross-platform. Infection hash values for NativeAPI are the same.
Ring0 - the source of inspiration
MD5: c6e73a75284507a41da8bef0db342400
https://www.virustotal.com/file/be00ef4 ... /analysis/
https://www.virustotal.com/file/be00ef4 ... /analysis/
Attachments
pass: infected
(172.5 KiB) Downloaded 88 times
(172.5 KiB) Downloaded 88 times
thisisu wrote:MD5: c6e73a75284507a41da8bef0db342400Unpacked container in attach. Notice few additional modules (e32, e64, w32, w64)
https://www.virustotal.com/file/be00ef4 ... /analysis/
Attachments
pass: malware
(112.91 KiB) Downloaded 68 times
(112.91 KiB) Downloaded 68 times
Ring0 - the source of inspiration
Services.exe infection code identified :)
Ring0 - the source of inspiration
EP_X0FF wrote:Services.exe infection code identified :)Nice! Looking forward to your analysis :)