Viruses, Anti-virus and Anti-anti-virus Techniques . Timid Virus Example with it's assembly code

5. Worm Propagation Leverage Network Connectivity

8. Trojan Leverages gullible users

11. Virus Virus – Needs a host V

12. Virus Propagation Leverage User Connectivity

15. Virus (Malware) Identification Anti-Virus Signature Virus Form - A Antivirus scanners use extracted patterns, or “signatures” to identify known malware. Signature

17. Static Signature Ex:- 8BEF 33C0 BF ?? ???? ?? 03 FDB9 ?? 0A 0000 8A85 ???? ???? 3007 47E2 FBEB

22. Metamorphism Example mov [ebp - 3], eax push ecx mov ecx,ebp add ecx,33 push esi mov esi,ecx sub esi,34 mov [esi-2],eax pop esi pop ecx push ecx mov ecx, ebp push eax mov eax, 33 add ecx, eax pop eax push esi mov esi, ecx push edx mov edx, 34 sub esi, edx pop edx mov [esi - 2], eax pop esi pop ecx push ecx mov ecx, [ebp + 10] mov ecx, ebp push eax add eax, 2342 mov eax, 33 add ecx, eax pop eax mov eax, esi push eax mov esi, ecx push edx xor edx, 778f mov edx, 34 sub esi, edx pop edx mov [esi-2], eax pop esi pop ecx push ecx mov ecx,ebp add ecx,33 mov [ecx-36],eax pop ecx

23. Attacking static signature- Metamorphism Anti-Virus Signature Virus Form - C M M Virus Virus Form - A Form - B Too many signatures challenge the AV Scanner Using different signatures for most variants cannot scale.

26. “ Undo” Metamorphism mov [ebp - 3], eax push ecx mov ecx,ebp add ecx,33 push esi mov esi,ecx sub esi,34 mov [esi-2],eax pop esi pop ecx push ecx mov ecx, ebp push eax mov eax, 33 add ecx, eax pop eax push esi mov esi, ecx push edx mov edx, 34 sub esi, edx pop edx mov [esi - 2], eax pop esi pop ecx push ecx mov ecx, [ebp + 10] mov ecx, ebp push eax add eax, 2342 mov eax, 33 add ecx, eax pop eax mov eax, esi push eax mov esi, ecx push edx xor edx, 778f mov edx, 34 sub esi, edx pop edx mov [esi-2], eax pop esi pop ecx push ecx mov ecx,ebp add ecx,33 mov [ecx-36],eax pop ecx

29. Virus Phylogeny [email_address] W32/Bagle.j@mm [email_address] W32/Klez.i@MM W32/NetSky.B [email_address] [email_address] [email_address] [email_address] W32/Bagle.a@mm [email_address] W32/Klez.f@MM W32/Bagle.ao@mm W32/Bagle.u@mm W32/Klez.e@MM W32.NetSky.D W32.NetSky.B W32.NetSky.A W32/Bugbear.17916intd W32/NetSky.A ??

30. Virus Phylogeny [email_address] [email_address] [email_address] [email_address] [email_address] [email_address] W32/Bagle.a@mm W32/Bagle.j@mm [email_address] W32/Klez.i@MM W32/Klez.f@MM W32/Bagle.aq@mm W32/Bagle.u@mm W32/Klez.e@MM W32.NetSky.D W32.NetSky.B W32.NetSky.A W32/Bugbear.17916intd W32/NetSky.B W32/NetSky.A ?? ?? Symantec McAfee

31. Deobfuscator of Calls NORMAL CALL L0: call L5 L1: … L2: … L3: … L4: … L5: <proc> L6: … Call Obfsucations to prevent static analysis OBFUSCATED CALL L0a: push L1 L0b: push L5 L0c: ret L1: … L2: … L3: … L4: … L5: <proc> L6: …

32. DOC: Deobfuscator of Calls DOC

36. Overwriting Viruses

37. Overwriting Viruses

38. Overwriting Viruses

39. Overwriting Viruses

41. Difference Between .COM and .EXE files

43. How to assemble it

47. TIMID The Host of our Virus TIMID

48. labels