Takayoshi Nakayama

Previously I blogged about W32.Changeup being a polymorphic worm written in Visual Basic. In this blog, I will discuss the threat author’s purpose for spreading the worm. When recent Changeup variants are executed, they attempt to acquire a host IP address from one of the following DNS

W32.Changeup is a type of polymorphic worm written in Visual Basic (VB) and as we stated in the previous W32.Changeup blog , our analysis is focusing on the polymorphic behavior that the threat employs. There are many polymorphic worms but polymorphic worms written in VB are very rare. Anal

It is well known that Trojan.Zbot was created by the ZeuS tool kit, and recently it has added the ability to infect files to its bag of tricks. A recently discovered Trojan.Zbot variant searches for executable files in a predefined place and injects the executable files it finds with 512 bytes