Date: Thu, 22 Jan 2004 00:08:29 -0800
From: Gadi Evron <[email protected]>
To: [email protected]Subject: AV products vulnerability [Fwd: [TH-research] Upx hack tool]
Cc: [email protected]
The below discussed tool in the forwarded message from TH-Research (The
Trojan Horses Research Mailing List) appears to enable malware to pass
right through the detection mechanisms of most AV products.
The reason this email message is forwarded is because this new.. erm..
let us call it a "packer" tricks quite a bit of the AV products in the
market.
Apparently either their engine's emulators can't handle it, or they do
not have one. Also, it is not screened by itself.
Screening this.. "packer" is very easy and can be done with a signature
for the short-term solution, it does not *require* an engine update.
One would expect an emulator to deal with it, but the surprise is not
too great and the weak spot is easy to fix.
Since it was announced on TH-Research a couple of days ago and all
member AV and AT firms should have updated their products, I am emailing
the world so the rest can update as well.
As we have seen many times, once one malware gets out and uses it, many
others soon will. The security concerns in not emailing this information
is not as serious as the risk if we do not.
The "packing" itself using this product, is rather simple to be un-done.
Thanks go to Rolles, Rolf for his help with proving the point and coding
an example for research purposes of defending against such malware.
Important note: the tool itself is perfectly legal. Many perfectly legal
packers are used by malware authors to try and "hide" their "creations"
from AV products.
I should also note that this new "packer" comes from the makers of PEcrypt.
As always, this message is forwarded according to the guidelines in the
TH-Research FAQ.
Gadi Evron.
The Trojan Horses Research Mailing List - http://ecompute.org/th-list
From: "Daniel Otis-Vigil"
To: TH-Research
Subject: [TH-research] Upx hack tool
Date: Tue, 20 Jan 2004 10:40:19 -0700
Mail from "Daniel Otis-Vigil"
Safe url: http://archphase.united.net.kg/projects.html
UPXredir
This tool takes a packed UPX file and smacks on a section and does a few
more things of trickery to transform it to not look like a UPX packed file
so when anti-virii comes only they can't decompress the packed data and see
it's raw form. Includes sourcecode and binary, written in Delphi 6.
Daniel Otis-Vigil
MooSoft Development
http://www.moosoft.com
-
TH-Research, the Trojan Horses Research mailing list.
List home page: http://ecompute.org/th-list
