Malware analysis with IDA/Radare2 - Multiple unpacking (Ramnit worm)

Introduction

Today we are following our previous post on these series unpacking a sample (Ramnit) that looks a bit more complex as it performs multiple unpacking, combining own methods with an open source packer. As this piece of malware is relatively old, I’ll be using a Windows 7 box with radare2, processhacker, pebear, pestudio and upx to go with it. The endgame here will be to go on unpacking the malware as many times as necessary until we reach to the final one, then get a general idea of what it does.

About Ramnit

Ramnit is a Computer worm affecting Windows users. It was estimated that it infected 800 000 Windows PCs between Septe…