How We Decoded Some Nasty Multi-Level Encoded Malware

http://blog.sucuri.net/2013/12/how-we-decoded-some-nasty-multi-level-encoded-malware.html

by cubictwo • 13 years ago

46 15 13 years ago

blog.sucuri.net

bbsec• 13 years ago

Great!

GhotiFish• 13 years ago

I must admit, I think the last step was a little. uhm... well I just think its funny how you used Hacker News to decrypt a script then posted about that on Hacker News.

JonnieCache3• 13 years ago

hopefully noodly will turn up and tell us how he/she did it.

EDIT: obviously bruteforce, but still.

bediger40002• 13 years ago

It's an XOR encryption, with a largish key - 12 bytes if I make the old hacker news comment correctly. If you do the standard known-text XOR key finding algorithm, you need a 24-byte known text.

That's some brute forcing, if you ask me.

mkarr• 13 years ago

A few months ago, I removed an almost identical piece of malware from a client's account. Looking through the server logs, I noticed that the script was still being accessed on a fairly regular basis. I dropped a simple script to dump the contents of the cookies and request variables to a file when accessed. It didn't take very long to obtain the key.

aroch• 13 years ago

Huh, how strange...I just cleaned the perl version of this out of a compromised user account on a server I manage.

VMG• 13 years ago

And re-encoded it into low-res PNGs?

How We Decoded Some Nasty Multi-Level Encoded Malware

Related Stories