3 ms·
The Intercept have now reported on this: https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/ https://firstlook.org/theintercep
by AlyssaRowan 12y ago
The Intercept have now reported on this:
https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/ https://firstlook.org/theintercept/2014/11/24/secret-regin-m...
For the truly curious, interested and daring enough to want to analyse nation-state malware, here's an actual live sample they've published. (Obviously, don't just run this code! Trite, I know, but… - password: "infected")
https://s3.amazonaws.com/tiregin/regin.zip https://s3.amazonaws.com/tiregin/regin.zip
Your tax dollars at work! … and mine. Bah.
- asbestosPants 12y agoIf I wanted to take that sample and actually run it inside a VM, what would I need to do? It looks like I need to know the file extension of each file and then rename the files?
- AlyssaRowan 12y agoUm… what you need to do is not do that. This is not incredibly technically sophisticated compared to some of the stuff I've seen, but it is still not a toy! Analyse it cold (from what I've seen from this, IDA Pro will be safe), or use a suitable simulator. Mainstream VMs are not designed for secure encapsulation and are very detectable: at least one of the loaders in one of the samples of this is specifically looking for VMs (and that's not unusual at all with any half-assed malware).