Bulletin

Part 2: Interaction with a black hole

Gabor Szappanos (Sophos)

Gabor Szappanos started with two fairly incomplete sources of information about the latest Blackhole server version: the server-side source code from old versions and the outgoing flow of malware. He describes how, using these sources, he was able to…

Compromised library

The Floxif DLL file infector implements both anti‑static- and anti-dynamic-analysis techniques. Raul Alvarez describes how.

Is our viruses learning?

It’s rare to see a virus advertised as demonstrating machine learning in any form, but W32/Grimgribber does just that. Peter Ferrie has the details.

Ramnit bot

First discovered in around April 2010, Ramnit is now not only a file infector that infects Windows Portable Executable files (.exe, .scr and .dll files) and HTML documents, but also a multi-component bot. Chao Chen takes a deep dive into Ramnit,…

Tracking the 2012 Sasfis campaign

Micky Pun (Fortinet)

Micky Pun unveils all the important nuts and bolts of the latest instalment of the Sasfis botnet by analysing its packers, core payloads and botnet operations.

Dissecting Winlocker – ransomware goes centralized

Winlocker, aka Gimemo, has revolutionized the design of ransomware - all the infected machines are controlled centrally using two C&C panels. Aditya Sood and colleagues discuss the design and behaviour of the Winlocker ransomware.

The cost of being scared safe

Stephen Cobb (ESET)

‘The throttling effect of fear on consumer uptake of online shopping and banking is certainly real.' Stephen Cobb, ESET.

Hacker forums provide clues to likely attack techniques

Much to be learned from monitoring hacker forums.

ZeroAccess infects 2.2 million

2.2 million home networks infected with ZeroAccess worldwide.

Three arrests in phishing case

UK authorities arrest three men in London.