Lessons learned from classic malware

Classic malware, although seemingly outdated in today’s threat world, serves as an invaluable teacher. Lessons learned from early malicious attempts shape our understanding of modern malware development techniques. In this section, we will continue to analyze classic malware, learn lessons, and examine real-life threat code snippets that once wreaked havoc on the digital landscape.

Look at the source code of one of the functions from the Carberp leak: https://github.com/nyx0/Carberp/blob/master/Source/GetApi.cpp.

Let’s look at the GetKernel32 function. This code appears to be an implementation of a function that retrieves the base address of the kernel32.dll module. The code uses a combination of assembly language and data structure traversal within the Process Environment Block (PEB) to achieve this.

Now, let’s break it down step by step:

__asm
{
  mov eax, FS:[0x30]
  mov [Peb], eax
}

As you...