This will focus on chapter 8 (malware analysis), you will need copy of the malware(WebcamShot.scr:)

The goal of this practical is to understand how the malware execute the hacker commands which isdelivered through IRC server.

hackarmy malware supports several commands as listed below.

our focus is going to be on two commands dontuseme and webfind64. Based on the description in the book, dontuseme will destroy the malware and webfind64 is used to download a file from the internet (or remote server) into the infected machine.

Answer the following questions: Q1. dontuseme command: a. From the assemble code of hackarmy malware, find where this command is implemented (verify your answer). b. In a step by step fashion, describe how this command is executed. c. using pseudocode rewrite this command. Q2. wibfind64 command: a. From the assemble code of hackarmy malware, find where this command is implemented (support your answer). b. In a step by step format describe how this command is executed. c. (grad only) using pseudocode rewrite this command. Hints: H1. Threads are usually used to execute code concurrently, for example if you are about to execute a piece of code that interacts with a slow resource (network, keyboard...etc.) rather than running it on the main thread which will hang the program, you can create a new thread to accomplish that. H2. When creating a thread, you pass a pointer to the code to be executed. H3. You can skip sub_4015A6.

LINK TO MALWARE: https://transfernow.net/127q0191zqjc

Command !?dontuseme lsock4 Ithreads info ?quit ?disconnect lexecute Idelete webfind64 !killprocess llistprocesses self destruct starts SOCK4 server on specified port list of threads list OS, network information stops backdoor disconnect from IRC server execute local binary deletes a specific file download file from remote server not working not working Command !?dontuseme lsock4 Ithreads info ?quit ?disconnect lexecute Idelete webfind64 !killprocess llistprocesses self destruct starts SOCK4 server on specified port list of threads list OS, network information stops backdoor disconnect from IRC server execute local binary deletes a specific file download file from remote server not working not working