Edit Publication: W32.Changeup: how the worm was created

You do not have permission to edit this page, for the following reason:

The action you have requested is limited to users in the group: Users.

Image:
Legend:
Botnet:
Malware:
Exploit kit:
Services:
Target:
Origin:
Campaign:
Feature:
Strings:
Distribution vector:
Vulnerability:
CCProtocol:
Programming language:
Botnet/malware group:
Operation/working group:
Year:
Date:
Editor/Conference:
Link:
DOI:
Author:
Type:
Abstract:	Since the first W32.Changeup was discovered in 2009, many variants have propagated around the world, accounting for 25 percent of all malware written in Visual Basic. The worm’s author periodically modifies the source code to avoid detection. Some variants are compiled to native code, while others are compiled to Pseudo-code. For this paper, a native code version of W32.Changeup was selected and decompiled in order to understand how the worm had been created and how the worm behaves. This paper presents the partial source code of the worm, as well as the method used to decompile a Visual Basic native code program by hand.

Free text:

Blog entry: http://www.symantec.com/connect/blogs/w32changeup-how-worm-was-created

Summary:

This is a minor edit

Watch this page