Cutwail : Malware With a Crash Reporting Feature.

Cutwail Spam component is a part of PushDo Botnet . Recently I was analysing Cutwail and came across an interesting patch reporting functionality in Cutwail .

It starts with Fixing IAT ( Import Address Table ) to correct corresponding addresses . This is done because this component of Pushdo is loaded and executed thought process Tunnelling / RunPE method

 
0
Kudos
 
0
Kudos

Now read this

A taste of our own medicine : How SmokeLoader is deceiving configuration extraction by using binary code as bait

A taste of our own medicine : How smokeloader is deceiving dynamic configuration extraction by using binary code as bait Recently an interesting smoke loader sample caught my eye ,and moreover I had to put smoke loader monitoring under... Continue →