(no subject)

[foxgrrl]

		call	InternetGetConnectedState
		test	eax, eax
		jz	short loc_9A3C5C
		lea	eax, [ebp+12Ch+SystemTime]
		push	eax		; lpSystemTime
		call	ebx ; GetLocalTime
		cmp	[ebp+12Ch+SystemTime.wYear], 7D9h
		ja	short loc_9A3C37
		jnz	short loc_9A3C4D
		cmp	[ebp+12Ch+SystemTime.wMonth], 4
		ja	short loc_9A3C37
		jnz	short loc_9A3C4D
		cmp	[ebp+12Ch+SystemTime.wDay], 1
		jb	short loc_9A3C4D

The above sequence of code has been the bane of my existence this week. It's the date check for April 1, 2009 from the Conficker.C worm. As with many other viruses in the past with a specific date that they do something, there is tremendous media hype surrounding this. So, I had not been analyzing this worm for the last few months, because everyone else had it covered, and I had other stuff to do, but now because of the media hype my company wants to have something published on it for marketing reasons. Since everyone else [see above] has published almost everything about it, there isn't much else for me to say. So I'm reversing the P2P protocol in Conficker.C, because it's the only part left… because it's the hardest part to understand. Anyway, I think I'll at least have figured out the IP address to UDP Port calculation soon, so I can write a scanner/Snort rule, for the P2P protocol. Anyway, don't interrupt me in the meantime…

(I was also going to write up a full analysis of the shellcode used in Conficker.A and Conficker.B, as no one else has really gone into detail there. (But the additional detail isn't really useful to know if you only care about detecting it. But I can describe who the authors copied most of their shellcode from (it's slightly modified MSF). Anyway, it'll be interesting to someone, but the P2P thing will get media attention.)

(Note: I'm not complaining. I'd much rather be reversing malware than working on what I was supposed to be doing this week.)

Comments

[two-pi-r.livejournal.com]

Did it even do anything on Apr1? Obviously, sorting the wheat from the bullshitchaff as regards news on this is a dicey proposition, given the day.

Oh. It just changes its domain name algorithm? How anticlimactic.

[databeast.livejournal.com]

I've been doing much the same (working on rulesets to ID the P2P traffic with)

but I've been going on observational behaviour and sandbox'ing more than reversing, mainly cos this little bugger is a bit outta my league.