Analysis of the techniques used by classic malware

Let’s start with examples of specific malware. Let’s take a look at a piece of code from the source code of the leaked Carberp banking Trojan. We will look at the source code in more detail in Chapter 15, but for now, let’s pay attention to specific functions.

Let’s look at the code of the leaked Carberp Trojan pushed on GitHub from the following link: https://github.com/nyx0/Carberp.

Let’s for example look at the functions in the file at https://github.com/nyx0/Carberp/blob/master/Source/Crypt.cpp.

Let’s see how the XORCrypt::Crypt function works. Let’s break down the provided C++ code step by step:

DWORD XORCrypt::Crypt(PCHAR Password, LPBYTE Buffer, DWORD Size) {
  DWORD a = 0, b = 0;
  a = 0;
  while (a < Size) {
    b = 0;
    while (Password[b]) {
      Buffer[a] ...