Log in

View Full Version : Exotic Malware ?

shakuni
June 2nd, 2008, 07:06
For my Malware Research I need samples of the following two kinds of Malware(description from Peter Szor's book). Please give me the names or samples of any of them,

Quote:
Octopus
An octopus is a sophisticated kind of computer worm that exists as a set of programs on more than one computer on a network.For example, head and tail copies are installed on individual computers that communicate with each other to perform a function.

Quote:
Rabbits
A rabbit is a special computer worm that exists as a single copy of itself at any point in time as it "jumps around" on networked hosts. Other researchers use the term rabbit to describe crafty, malicious applications that usually run themselves recursively to fill memory with their own copies and to slow down processing time by consuming CPU time. Such malicious code uses too much memory and thus can cause serious side effects on a machine within other applications that are not prepared to work under low-memory conditions and that unexpectedly cease functioning.


Thanks.
esther
June 2nd, 2008, 12:07
Seriously either you are dumb,retarted or...
Asking malicious programs are lame
Silver
June 2nd, 2008, 12:36
Have I been living under a rock, or is that the first time everyone else has heard malware called "octopus" and "rabbit"?

Go email SARC or Grisoft or someone, I'm sure it won't be hard to get virus samples for legitimate research.
shakuni
June 2nd, 2008, 14:39
Quote:
Seriously either you are dumb,retarted or...
Asking malicious programs are lame

Just give me the names at least (that is, if you know of any). I need 'em just for the completeness of the research project of mine.

Quote:
Have I been living under a rock, or is that the first time everyone else has heard malware called "octopus" and "rabbit"?

Probably yes because they are mentioned in the best book on AV research out there. (The Art of Computer Virus Research And Defence by Peter Szor).

Quote:
Go email SARC or Grisoft or someone, I'm sure it won't be hard to get virus samples for legitimate research.

Done. I think that you probably know that it is "not hard" to get virus samples or sources these days. What is hard is to get the samples of these exotic viruses. Thus the post.

Anyways, Thanks for replying.
disavowed
June 25th, 2008, 12:46
FYI, many terms in Szor's book (such as "octopus" and "rabbit" in the context above) are very outdated and no longer used in the AV industry. And for what it's worth, I've never seen any real-world malware that acts in those ways.
ktwo
August 10th, 2008, 05:53
I hadn't seen exactally that sort of behaviour either, but I have seen things simular to http://www.codeproject.com/KB/cpp/VirusProtect.aspx what's described there as Robin Hood and Friar Tuck. It's a real pain to debug, as they wont run in a VM, they never let a real debugger see what's going on (multiple threads egress/ingres the mal payload on createdebugobject req). The best way I found to analyze these things at run time was using more of a profiling application like procmon. Statically, I have a databased archive of every md5 of every file I have, and also every 512bytes and every PAGE_SIZE, helps when analyzing physical-memory captures or pagefile/disk images.

Advanced functionality is becomming more common these days. Multiple command&control techniques/packers/anti-eng, somtimes compleatly new others variations on a theme. I've also noticed a rise in NAT traversial communication methods being used.

I dont know why asking for code is lame, but you can get a ton at http://vx.netlux.org, also just browse the internet with English (dont use chineesiese as some site's wont infect you) XP0, your sure to have a few dozen malware's on your system in a matter of hours. I guess advanced mal/virii is a bit more of a gamble, netlux.org only has 1 entry for 2008, but you are sure to bet that while attempting some industrial esponiage or whatever, the red army's of the world will be using home/dsl/cable proxy's for some of thire assult. So just keep your system infected, and watch for something interesting. Oh ya, change your local system's domain name to something interesting, maybe laptop-41432.uber.secret.research.and.development.com