A jump that does not jump and a ZIP missing 177 KB
Somebody took the WannaCry worm, zeroed the kill-switch URL and neutered the jump that checked it. Two patches, and the sinkhole that stopped the May 2017 outbreak stops being useful. In the same package, the ZIP holding the encryption engine is missing its last 177 KB and with them the central directory: the malware's own ZIP library cannot open it. The result is a worm that spreads without encrypting anything.
A key that is the relocation table and a thread that starts in the wrong place
ZeuS 2.0.8.9, the bot whose source leaked a month after this sample was built. It does not hide its configuration behind a key: it encrypts it against its own relocation table, which exists in every PE and which nobody looks at. And to inject itself it does not use CreateRemoteThread: it rewrites one context register before the thread exists, and lets Windows create it wherever it says.
A payload in 61 pieces and a PE header that erases itself
A one-megabyte executable of which only 100 KB is malware: the rest is random noise. The payload travels split into 61 fragments that are only decrypted once reassembled, the PE header is rebuilt field by field in memory and wiped again afterwards, and there is not a single real string or import. The folder said Zeus; it is Dridex.
Five stages, a PNG and a plaintext password
A 604 KB dropper hides an infostealer behind ConfuserEx, steganography in an image’s pixels, .NET Reactor and two hand-rolled XOR layers. Five stages down to the payload, which exfiltrates over SMTP with the credentials embedded in the binary.
No entries with that tag.