Blackrota: obfuscated backdoor written in Go
I cant really enjoy articles like this after seeing:
<a href="https://z0mbie.dreamhosters.com/" rel="nofollow">https://z0mbie.dreamhosters.com/</a> (yes, site looks like crap by today standards, but author was an evil genius)<p>and<p><a href="https://z0mbie.dreamhosters.com/autorev.txt" rel="nofollow">https://z0mbie.dreamhosters.com/autorev.txt</a>
<a href="https://z0mbie.dreamhosters.com/src/mistfall2/index.html" rel="nofollow">https://z0mbie.dreamhosters.com/src/mistfall2/index.html</a><p>"The virus supports a unique new technique: code integration. The Mistfall engine contained in the virus is capable of decompiling Portable Executable files to its smallest elements, requiring 32MB of memory. Zmist will insert itself into the code: it moves code blocks out of the way, inserts itself, regenerates code and data references (including relocation information), and rebuilds the executable. This is something that has not been seen in any previous virus. Zmist occasionally inserts jump instructions after every single instruction of the code section, each ofwhich will point to the next instruction. Amazingly, these horribly modified applications will still run as before, just like the infected executables do, from generation to generation. In fact we have not seen a single crash during the test replications. Nobody expected this to work, not even its author Zombie.Although it is not foolproof it seems to be good enough for a virus. It takes time for an individual to  find  the  virus  in  infected  files,  due  to  Zmist's  extreme  camouflage,  making  it  the  perfect  anti-heuristics virus."<p>Search here for Zmist (Mistfall is the engine with sources in previous links) description:
<a href="https://crypto.stanford.edu/cs155old/cs155-spring09/papers/viruses.pdf" rel="nofollow">https://crypto.stanford.edu/cs155old/cs155-spring09/papers/v...</a><p>What I am seeing today as malware is a joke compared to those times. The knowledge is just lost.