A forum for reverse engineering, OS internals and malware analysis
TrendLabs has created a STUXNET Scanner Tool to further help administrators with clues to determine which computers in their networks are still infected by STUXNET.
Who controls the past controls the future
Who controls the present controls the past
Who controls the present controls the past
News: Stuxnet code leaks to some underground forum. Someone knows which one?
Someone can help or tell as to get a file or dump with a code privilege escalation via keyboard layout file (ms10-073). thanks.
@blast
Stuxnet uses special dll for this purpose.
Stuxnet uses special dll for this purpose.
Attachments
pass: malware
(19.55 KiB) Downloaded 88 times
(19.55 KiB) Downloaded 88 times
Ring0 - the source of inspiration
blast wrote:Someone can help or tell as to get a file or dump with a code privilege escalation via keyboard layout file (ms10-073). thanks.Set bp on win32k!NtUserLoadKeyboardLayoutEx and run sample from this thread. When bp occurs - trace from syscall return back to the malware code. And finnaly, trace malware code up to the SendInput() call.
You sould see something like this (HexRays): http://www.everfall.com/paste/id.php?2p9sflyub177
EP_X0FF, Cr4sh. big thanks.
Cr4sh: Problem in that that I can't start any sample from this thread. Maybe problem in vmware setting or somthing like that, my friend have the same problems.
Cr4sh: Problem in that that I can't start any sample from this thread. Maybe problem in vmware setting or somthing like that, my friend have the same problems.
Try this. Rename both files to their original names.
~wtr4141.tmp for dll
~wtr4132.tmp for dropper
put them together somewhere on disk (for example in root dir)
cmd -> start c:\~wtr4132.tmp
It should work.
~wtr4141.tmp for dll
~wtr4132.tmp for dropper
put them together somewhere on disk (for example in root dir)
cmd -> start c:\~wtr4132.tmp
It should work.
Attachments
pass: malware
(511.74 KiB) Downloaded 138 times
(511.74 KiB) Downloaded 138 times
Ring0 - the source of inspiration
Hello,
Iran has confirmed that Stuxnet has caused problems for some of their nuclear enrichment facilities. I think this is as close to a confirmation that we will ever see ;)
Thanks,
--AD
Iran has confirmed that Stuxnet has caused problems for some of their nuclear enrichment facilities. I think this is as close to a confirmation that we will ever see ;)
Thanks,
--AD
