Backdoor.Win32.UltimateDefender.gtz - Reversing

[Nytro]

Backdoor.Win32.UltimateDefender.gtz - Reversing

In this paper (Backdoor.Win32.UltimateDefender.gtz - Reversing) we analyze install.exe that presents the typical structure of an Medium Evoluted Malware, with basical Obfuscated-Dummy Code, some layer of Encryption decoded at Runtime and Custom Hash Functions used as Integrity Check. We can also see an intersting technique that retrieves API's Addresses OnDemand through a series of hardcoded values that corresponds to some API, the correspondent API Address is computated at runtime and chosen in function of the Hardcoded Value.

Download:

http://rootkitanalytics.com/papers/pdf/Backdoor-UltimateDefender.pdf