How would you go about reverse engineering malware W32/Malware!Gemini. Recently I found it installed on my computer and would like to trace where the data is being sent.

1 Answer 1


Well there's a slight difference between the two.

The best way to try and determine where the data is being sent is to monitor and trace all of your outbound traffic.

If you'd like to reverse engineer it to possibly learn more about it and if you are missing anything as far as what it is doing or what it is sending there'd be a slightly different path.

Monitoring a clean and controlled system, using packet sniffers in conjunction with IDS(s), trying to disassemble any binaries you find that it adds, debugging/looking at the strings/hexediting as best you can should garner you plenty more information about it than you currently know.

  • So wireshark to sniff. Where would I start? Any specific filters that would be more likely to sniff this exact traffic? Do you have a IDS that you recommend? Thank you for the reply.
    – m4ck
    Jan 29, 2012 at 6:12
  • @m4ck - You want an honest answer? If you do not already know where to start, then you do not have the tools nor the ability to track where the data is being sent to, besides what are you going to do if you do find the desination of the data? I guarantee you its in a country that could careless about your rights.
    – Ramhound
    Jan 30, 2012 at 15:11
  • 1
    Everyone has to start somewhere. I would forward the information I found to proper authorities or someone that might possible care or take proper action. Or use the information for record keeping purposes.
    – m4ck
    Jan 30, 2012 at 16:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.