CartellaUnicaTasse.exe Italian Malware RCE Analysis

[evilcry]

Hi,
I've just released a paper into my website about the RCE Analysis of an italian Downloader

Paper can be reached here:

http://evilcry.altervista.org/tuts/Mw/CartellaUnicaTasse.pdf

if this link does not works, just reach it from the home of my website.

Regards,
Evilcry

[JMI]

Thanks evilcry for sharing with our readers.

Regards,

[evilcry]

Thanks for you feedback JMI

[Daniel Pistelli]

I'm not affected. I deleted the vb5 and vb6 runtime from my computer.

Others should do the same.

Being infected by a vb6 malaware is just too much. Imagine only the pain in reversing it.

[bilbo]

Quote:

[Originally Posted by Daniel Pistelli]Imagine only the pain in reversing it.

The pain? Did you want to say the fun?

[evilcry]

Quote:

[Originally Posted by bilbo;76164]The pain? Did you want to say the fun?

I don't think that Ntoskrnl used the wrong term, VB and Delphi are truly boring to reverse, too much overbloated..