da3m0n s3c

UPDATE [l] : shortly after finishing this post, I had decided to do a couple scans of the raw code. The results returned several Shell Trojan variants, and doing some permanent damage to windows systems. Reports available at ] VirusTotal ] and [ Malwr ]. Thanks to both services for the great results. It attempted network connx with the original url, not surprise from a webshell, IMO, only a bit strange that the likely 0wn/Op would keep such a trophy case in the wild like that? I mean really??. I would've expected an http request or few since nce that's who was hosting the assets but the requests were made to connect to "Hostthshellcode and then starts the endless streaming of the v1c's data and a continual stream of fresh code for the mal to swap out. This only confirmed the feeling I had about the src code. Multiple langs being used, illogical syntax and it's all just mixed together... if anyone can answer how this can support the back and forth exec using Perl,...

Over the years I have seen and worked on my share of malware, watched as the vulz and exploits come and go. After a few years in frey, one becomes very attuned to the world that's surrounds them. This sixth sense is an asset and more valuable now than any other time, welcome to the new era of malz. This is a hidden world, where silence, stealth and pure imagination contribute to what is normally a quiet infection. Distinguished with highly-complex coding, persistence and it's signature polymorphic design. Those involved in cybersec know of this new breed, stealth and delivery, as well as those who design and code them. This is a journey leading to, and the analysis of a recent live malware discovery by myself. This write-up will highlight the importance of a full skill set and how that sixth sense comes into play. I am, however, leaving out some crucial information on certain parts. This is in consideration that the malware and delivery structure is still in the wild. We hav...