Bulletin

ProxyCB, a spam proxy under the radar

Kyle Yang (Fortinet)

ProxyCB is a trojan that acts as a proxy server to send spam via the HTTP, HTTPS or SMTP protocol. Wei Wang and Kyle Yang take a detailed look at its installation process, how it bypasses UAC, and the final payload loading process, before dissecting…

BYOT: Bring Your Own Target

Gabor Szappanos (Sophos)

The author of Simbot doesn’t take anything for granted: all the necessary components for the malware’s execution are bundled and dropped onto the system, including the relevant vulnerable application for exploitation and regular Windows system…

Solarbot botnet

Solarbot, a.k.a. Dapato or Napolar, is a traditional botnet that has been around for a while. It is used for spreading other malware and often comes with built-in DDoS and proxy modules. He Xu takes a closer look.

A short visit with a virus

Last month, Peter Ferrie described a Windows virus that turns Java class files into droppers for the virus, and concluded that it would be a simple matter to reverse that: for a virus writer to create a Java class file that turns Windows files into…

Getting one's hands dirty

Cross-platform execution is one of the promises of Java - but cross-platform infection is probably not what the designers had in mind. Nevertheless, it was clearly in the mind of the author of W32/Java.Grimy, a virus for the Windows platform, which…

Needle in a haystack

Gabor Szappanos (Sophos)

Sometimes what looks like a genuine MP3 encoder library, and even works as a functional encoder, actually hides malicious code deep amongst a pile of clean code. Gabor Szappanos reveals the lengths to which one piece of malware goes to hide its…

Salted algorithm - part 2

Sality has been around for many years, yet it is still one of today’s most prevalent pieces of malware. Last month, Raul Alvarez described Sality’s algorithm, showing the strengths of its encryption, how it uses the stack as temporary memory for code…

Inside W32.Xpaj.B’S infection – part 2

Xpaj.B is one of the most complex and sophisticated file infectors in the world. It is difficult to detect, disinfect and analyse. Liang Yuan provides a deep analysis of its infection.

Don't forget to write

David Harley (ESET)

Industry veteran, prolific writer and educator David Harley reviews two recently published eBooks that aim to provide security guidance for consumers: Improve Your Security by Sorin Mustaca, and One Parent to Another by Tony Anscombe.

It is time for defenders to go on the offence

‘Challenge [defenders] to take a penetration testing or exploit development class.' Andreas Lindh