SlideShare a Scribd company logo

Black Energy18 - Russian botnet package analysis

Roberto Suggi Liverani
Roberto Suggi LiveraniPentester/Reseacher
© 2008 Security-Assessment.com Black Energy 1.8 Russian web-based botnet package analysis Presented By Roberto Suggi Liverani
Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Background ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
What’s in the package? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
What’s in the package? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Building the backdoor ,[object Object],[object Object]
Building the backdoor ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Infection Analysis ,[object Object],[object Object],[object Object],[object Object]
Infection Analysis - Methodology ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Infection Analysis – Dynamic/Static Analysis ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Dynamic Analysis – Tools ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Dynamic Analysis – Windows Register ,[object Object],[object Object],[object Object],[object Object],[object Object]
Dynamic Analysis – File System ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Dynamic Analysis – File System ,[object Object],[object Object]
Dynamic Analysis – Network/Processes ,[object Object],[object Object],[object Object],[object Object]
Dynamic Analysis – Network/Processes ,[object Object],[object Object],[object Object],[object Object]
Dynamic Analysis – Network/Processes ,[object Object],[object Object]
Static Analysis – Reversing malware ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Static Analysis – Reversing malware ,[object Object],[object Object],[object Object],[object Object]
Static Analysis – Reversing malware ,[object Object]
Static Analysis – Reversing malware ,[object Object],[object Object],[object Object],[object Object]
Static Analysis – Reversing malware ,[object Object],[object Object]
Static Analysis – Reversing malware ,[object Object],[object Object]
Static Analysis – Reversing malware ,[object Object]
Static Analysis – Reversing malware ,[object Object],[object Object]
Static Analysis – Reversing malware ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Static Analysis – Reversing malware ,[object Object],Crypted _bot.exe is stored at 13112000 Crypted_.131111b9 decrypts _bot.exe to 00320000 Note that the different size: 6000 and 3000
C&C System Architecture ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
C&C System Architecture ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
C&C System Architecture ,[object Object]
C&C System Architecture ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
C&C System Architecture ,[object Object],[object Object]
C&C System Architecture ,[object Object],[object Object],[object Object]
C&C System Architecture ,[object Object]
C&C System Architecture ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
C&C System Architecture ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Botnet Communication ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
DDoS Attacks Overview ,[object Object],[object Object],[object Object]
DDoS Attacks Overview ,[object Object],[object Object]
Defenses and Countermeasures ,[object Object],[object Object],[object Object],[object Object],[object Object]
Defenses and Countermeasures ,[object Object]
Defenses and Countermeasures ,[object Object]
Defenses and Countermeasures ,[object Object],[object Object],[object Object],[object Object],[object Object]
Conclusions ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Demo ,[object Object],[object Object],[object Object],[object Object],[object Object]
Questions? © 2007 Security-Assessment.com http://www.security-assessment.com [email_address]
References ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
References ,[object Object],[object Object],[object Object]
1 of 48

Black Energy18 - Russian botnet package analysis

Download to read offline

From the infection phase to the command & control functionalities, this talk is a 360 degrees analysis of a recent Russian botnet distribution package. Particular features of this botnet are communication over HTTP protocol and use of PHP and Mysql.

Roberto Suggi Liverani
Roberto Suggi LiveraniPentester/Reseacher

Recommended

Investigating Hackers' Tools by
Investigating Hackers' ToolsInvestigating Hackers' Tools
Investigating Hackers' ToolsIsrael Umana
835 views37 slides
Malware Analysis and Defeating using Virtual Machines by
Malware Analysis and Defeating using Virtual MachinesMalware Analysis and Defeating using Virtual Machines
Malware Analysis and Defeating using Virtual Machinesintertelinvestigations
1.4K views74 slides
Ch0 1 by
Ch0 1Ch0 1
Ch0 1TylerDerdun
79 views72 slides
Volatile IOCs for Fast Incident Response by
Volatile IOCs for Fast Incident ResponseVolatile IOCs for Fast Incident Response
Volatile IOCs for Fast Incident ResponseTakahiro Haruyama
3.4K views56 slides
Basic malware analysis by
Basic malware analysisBasic malware analysis
Basic malware analysissecurityxploded
3.7K views33 slides
Malware analysis - What to learn from your invaders by
Malware analysis - What to learn from your invadersMalware analysis - What to learn from your invaders
Malware analysis - What to learn from your invadersTazdrumm3r
943 views27 slides
OceanLotus Ships New Backdoor Using Old Tricks by
OceanLotus Ships New Backdoor Using Old TricksOceanLotus Ships New Backdoor Using Old Tricks
OceanLotus Ships New Backdoor Using Old TricksESET Middle East
397 views21 slides
Building HMI with VB Tutorial [1998] by
Building HMI with VB Tutorial [1998]Building HMI with VB Tutorial [1998]
Building HMI with VB Tutorial [1998]Sarod Paichayonrittha
5.3K views46 slides

More Related Content

What's hot

SANS Windows Artifact Analysis 2012 by
SANS Windows Artifact Analysis 2012SANS Windows Artifact Analysis 2012
SANS Windows Artifact Analysis 2012Rian Yulian
2.7K views1 slide
CNIT 126: 10: Kernel Debugging with WinDbg by
CNIT 126: 10: Kernel Debugging with WinDbgCNIT 126: 10: Kernel Debugging with WinDbg
CNIT 126: 10: Kernel Debugging with WinDbgSam Bowne
814 views81 slides
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak... by
Revealing the Attack Operations Targeting Japan by  Shusei Tomonaga & Yuu Nak...Revealing the Attack Operations Targeting Japan by  Shusei Tomonaga & Yuu Nak...
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...CODE BLUE
5K views94 slides
Anomalies Detection: Windows OS - Part 1 by
Anomalies Detection: Windows OS - Part 1Anomalies Detection: Windows OS - Part 1
Anomalies Detection: Windows OS - Part 1Rhydham Joshi
2.6K views47 slides
Practical Malware Analysis: Ch 11: Malware Behavior by
Practical Malware Analysis: Ch 11: Malware BehaviorPractical Malware Analysis: Ch 11: Malware Behavior
Practical Malware Analysis: Ch 11: Malware BehaviorSam Bowne
3.3K views59 slides
Malware analysis by
Malware analysisMalware analysis
Malware analysisPrakashchand Suthar
3.4K views39 slides
Practical Malware Analysis: Ch 10: Kernel Debugging with WinDbg by
Practical Malware Analysis: Ch 10: Kernel Debugging with WinDbgPractical Malware Analysis: Ch 10: Kernel Debugging with WinDbg
Practical Malware Analysis: Ch 10: Kernel Debugging with WinDbgSam Bowne
3.5K views93 slides
Anatomy of Exploit Kits by
Anatomy of Exploit KitsAnatomy of Exploit Kits
Anatomy of Exploit Kitssecurityxploded
3.8K views24 slides
Hunting Lateral Movement in Windows Infrastructure by
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureSergey Soldatov
9.1K views52 slides
Catching fileless attacks by
Catching fileless attacksCatching fileless attacks
Catching fileless attacksBalaji Rajasekaran
501 views14 slides
CNIT 126 11. Malware Behavior by
CNIT 126 11. Malware BehaviorCNIT 126 11. Malware Behavior
CNIT 126 11. Malware BehaviorSam Bowne
227 views64 slides
Memory forensics cheat sheet by
Memory forensics cheat sheetMemory forensics cheat sheet
Memory forensics cheat sheetMartin Cabrera
1.9K views2 slides
Hunting Rootkit From the Dark Corners Of Memory by
Hunting Rootkit From the Dark Corners Of MemoryHunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of Memorysecurityxploded
2.9K views13 slides
MNSEC 2018 - Windows forensics by
MNSEC 2018 - Windows forensicsMNSEC 2018 - Windows forensics
MNSEC 2018 - Windows forensicsMNCERT
882 views39 slides
One-Byte Modification for Breaking Memory Forensic Analysis by
One-Byte Modification for Breaking Memory Forensic AnalysisOne-Byte Modification for Breaking Memory Forensic Analysis
One-Byte Modification for Breaking Memory Forensic AnalysisTakahiro Haruyama
3.9K views61 slides
Basic Malware Analysis by
Basic Malware AnalysisBasic Malware Analysis
Basic Malware AnalysisAlbert Hui
4.4K views20 slides
Hunting for Privilege Escalation in Windows Environment by
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentTeymur Kheirkhabarov
12K views99 slides
Windows Crash Dump Analysis by
Windows Crash Dump AnalysisWindows Crash Dump Analysis
Windows Crash Dump AnalysisMicrosoft TechNet - Belgium and Luxembourg
1.1K views34 slides
Kunal - Introduction to backtrack - ClubHack2008 by
Kunal - Introduction to backtrack - ClubHack2008Kunal - Introduction to backtrack - ClubHack2008
Kunal - Introduction to backtrack - ClubHack2008ClubHack
859 views25 slides
Workshop on BackTrack live CD by
Workshop on BackTrack live CDWorkshop on BackTrack live CD
Workshop on BackTrack live CDamiable_indian
3.2K views25 slides

What's hot (20)

SANS Windows Artifact Analysis 2012 by Rian Yulian
SANS Windows Artifact Analysis 2012SANS Windows Artifact Analysis 2012
SANS Windows Artifact Analysis 2012
Rian Yulian2.7K views
CNIT 126: 10: Kernel Debugging with WinDbg by Sam Bowne
CNIT 126: 10: Kernel Debugging with WinDbgCNIT 126: 10: Kernel Debugging with WinDbg
CNIT 126: 10: Kernel Debugging with WinDbg
Sam Bowne814 views
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak... by CODE BLUE
Revealing the Attack Operations Targeting Japan by  Shusei Tomonaga & Yuu Nak...Revealing the Attack Operations Targeting Japan by  Shusei Tomonaga & Yuu Nak...
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
CODE BLUE5K views
Anomalies Detection: Windows OS - Part 1 by Rhydham Joshi
Anomalies Detection: Windows OS - Part 1Anomalies Detection: Windows OS - Part 1
Anomalies Detection: Windows OS - Part 1
Rhydham Joshi2.6K views
Practical Malware Analysis: Ch 11: Malware Behavior by Sam Bowne
Practical Malware Analysis: Ch 11: Malware BehaviorPractical Malware Analysis: Ch 11: Malware Behavior
Practical Malware Analysis: Ch 11: Malware Behavior
Sam Bowne3.3K views
Practical Malware Analysis: Ch 10: Kernel Debugging with WinDbg by Sam Bowne
Practical Malware Analysis: Ch 10: Kernel Debugging with WinDbgPractical Malware Analysis: Ch 10: Kernel Debugging with WinDbg
Practical Malware Analysis: Ch 10: Kernel Debugging with WinDbg
Sam Bowne3.5K views
Hunting Lateral Movement in Windows Infrastructure by Sergey Soldatov
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows Infrastructure
Sergey Soldatov9.1K views
CNIT 126 11. Malware Behavior by Sam Bowne
CNIT 126 11. Malware BehaviorCNIT 126 11. Malware Behavior
CNIT 126 11. Malware Behavior
Sam Bowne227 views
Memory forensics cheat sheet by Martin Cabrera
Memory forensics cheat sheetMemory forensics cheat sheet
Memory forensics cheat sheet
Martin Cabrera1.9K views
Hunting Rootkit From the Dark Corners Of Memory by securityxploded
Hunting Rootkit From the Dark Corners Of MemoryHunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of Memory
securityxploded2.9K views
MNSEC 2018 - Windows forensics by MNCERT
MNSEC 2018 - Windows forensicsMNSEC 2018 - Windows forensics
MNSEC 2018 - Windows forensics
MNCERT882 views
One-Byte Modification for Breaking Memory Forensic Analysis by Takahiro Haruyama
One-Byte Modification for Breaking Memory Forensic AnalysisOne-Byte Modification for Breaking Memory Forensic Analysis
One-Byte Modification for Breaking Memory Forensic Analysis
Takahiro Haruyama3.9K views
Basic Malware Analysis by Albert Hui
Basic Malware AnalysisBasic Malware Analysis
Basic Malware Analysis
Albert Hui4.4K views
Hunting for Privilege Escalation in Windows Environment by Teymur Kheirkhabarov
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows Environment
Kunal - Introduction to backtrack - ClubHack2008 by ClubHack
Kunal - Introduction to backtrack - ClubHack2008Kunal - Introduction to backtrack - ClubHack2008
Kunal - Introduction to backtrack - ClubHack2008
ClubHack859 views
Workshop on BackTrack live CD by amiable_indian
Workshop on BackTrack live CDWorkshop on BackTrack live CD
Workshop on BackTrack live CD
amiable_indian3.2K views

Viewers also liked

Botnets - Detection and Mitigation by
Botnets - Detection and MitigationBotnets - Detection and Mitigation
Botnets - Detection and MitigationAjit Skanda Kumaraswamy
1.2K views18 slides
Global Botnet Detector by
Global Botnet DetectorGlobal Botnet Detector
Global Botnet DetectorBrenton Mallen
772 views38 slides
2 dc meet new by
2 dc meet new2 dc meet new
2 dc meet newkirubavenkat
194 views25 slides
The Godfather - P2P Botnets: Security & Communication by
The Godfather -  P2P Botnets: Security & CommunicationThe Godfather -  P2P Botnets: Security & Communication
The Godfather - P2P Botnets: Security & CommunicationArturBalanuta
1.7K views33 slides
Création d'un botnet et défense by
Création d'un botnet et défenseCréation d'un botnet et défense
Création d'un botnet et défenseESD Cybersecurity Academy
1.2K views16 slides
The Harvester, the Botmaster, and the Spammer: On the Relations Between the D... by
The Harvester, the Botmaster, and the Spammer: On the Relations Between the D...The Harvester, the Botmaster, and the Spammer: On the Relations Between the D...
The Harvester, the Botmaster, and the Spammer: On the Relations Between the D...Gianluca Stringhini
1.5K views19 slides
شناسایی بات نت های Fast-Flux با استفاده از تحلیل ناهنجاری DNS by
شناسایی بات نت های Fast-Flux با استفاده از تحلیل ناهنجاری DNSشناسایی بات نت های Fast-Flux با استفاده از تحلیل ناهنجاری DNS
شناسایی بات نت های Fast-Flux با استفاده از تحلیل ناهنجاری DNSMahdi Sayyad
1.6K views32 slides
Cryptovirology Introduction, SecurityThreats, Safeguards and Countermeasures by
Cryptovirology Introduction, SecurityThreats, Safeguards and CountermeasuresCryptovirology Introduction, SecurityThreats, Safeguards and Countermeasures
Cryptovirology Introduction, SecurityThreats, Safeguards and CountermeasuresM Mehdi Ahmadian
458 views46 slides
Barcamp2015 cyberguerre et-botnet by
Barcamp2015 cyberguerre et-botnetBarcamp2015 cyberguerre et-botnet
Barcamp2015 cyberguerre et-botnetBarcampCameroon
646 views23 slides
آشنایی با جرم‌یابی قانونی رایانه‌ای by
آشنایی با جرم‌یابی قانونی رایانه‌ایآشنایی با جرم‌یابی قانونی رایانه‌ای
آشنایی با جرم‌یابی قانونی رایانه‌ایRamin Najjarbashi
521 views19 slides
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1 by
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1  Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1 securityxploded
14.5K views31 slides
Botnet Architecture by
Botnet ArchitectureBotnet Architecture
Botnet ArchitectureBhagath Singh Jayaprakasam
6.6K views26 slides

Viewers also liked (12)

The Godfather - P2P Botnets: Security & Communication by ArturBalanuta
The Godfather -  P2P Botnets: Security & CommunicationThe Godfather -  P2P Botnets: Security & Communication
The Godfather - P2P Botnets: Security & Communication
ArturBalanuta1.7K views
The Harvester, the Botmaster, and the Spammer: On the Relations Between the D... by Gianluca Stringhini
The Harvester, the Botmaster, and the Spammer: On the Relations Between the D...The Harvester, the Botmaster, and the Spammer: On the Relations Between the D...
The Harvester, the Botmaster, and the Spammer: On the Relations Between the D...
Gianluca Stringhini1.5K views
شناسایی بات نت های Fast-Flux با استفاده از تحلیل ناهنجاری DNS by Mahdi Sayyad
شناسایی بات نت های Fast-Flux با استفاده از تحلیل ناهنجاری DNSشناسایی بات نت های Fast-Flux با استفاده از تحلیل ناهنجاری DNS
شناسایی بات نت های Fast-Flux با استفاده از تحلیل ناهنجاری DNS
Mahdi Sayyad1.6K views
Cryptovirology Introduction, SecurityThreats, Safeguards and Countermeasures by M Mehdi Ahmadian
Cryptovirology Introduction, SecurityThreats, Safeguards and CountermeasuresCryptovirology Introduction, SecurityThreats, Safeguards and Countermeasures
Cryptovirology Introduction, SecurityThreats, Safeguards and Countermeasures
M Mehdi Ahmadian458 views
Barcamp2015 cyberguerre et-botnet by BarcampCameroon
Barcamp2015 cyberguerre et-botnetBarcamp2015 cyberguerre et-botnet
Barcamp2015 cyberguerre et-botnet
BarcampCameroon646 views
آشنایی با جرم‌یابی قانونی رایانه‌ای by Ramin Najjarbashi
آشنایی با جرم‌یابی قانونی رایانه‌ایآشنایی با جرم‌یابی قانونی رایانه‌ای
آشنایی با جرم‌یابی قانونی رایانه‌ای
Ramin Najjarbashi521 views
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1 by securityxploded
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1  Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
securityxploded14.5K views

Similar to Black Energy18 - Russian botnet package analysis

Basic malware analysis by
Basic malware analysis Basic malware analysis
Basic malware analysis Cysinfo Cyber Security Community
512 views33 slides
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis by
Reversing & Malware Analysis Training Part 9 -  Advanced Malware AnalysisReversing & Malware Analysis Training Part 9 -  Advanced Malware Analysis
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysissecurityxploded
9.5K views44 slides
Two-For-One Talk: Malware Analysis for Everyone by
Two-For-One Talk: Malware Analysis for EveryoneTwo-For-One Talk: Malware Analysis for Everyone
Two-For-One Talk: Malware Analysis for EveryonePaul Melson
1.9K views44 slides
Cyber Defense Forensic Analyst - Real World Hands-on Examples by
Cyber Defense Forensic Analyst - Real World Hands-on ExamplesCyber Defense Forensic Analyst - Real World Hands-on Examples
Cyber Defense Forensic Analyst - Real World Hands-on ExamplesSandeep Kumar Seeram
46 views17 slides
Pursue the Attackers – Identify and Investigate Lateral Movement Based on Beh... by
Pursue the Attackers – Identify and Investigate Lateral Movement Based on Beh...Pursue the Attackers – Identify and Investigate Lateral Movement Based on Beh...
Pursue the Attackers – Identify and Investigate Lateral Movement Based on Beh...CODE BLUE
1.4K views88 slides
Malware analysis by
Malware analysisMalware analysis
Malware analysisDen Iir
386 views9 slides
Intrusion Discovery on Windows by
Intrusion Discovery on WindowsIntrusion Discovery on Windows
Intrusion Discovery on Windowsdkaya
734 views22 slides
Malware Analysis Made Simple by
Malware Analysis Made SimpleMalware Analysis Made Simple
Malware Analysis Made SimplePaul Melson
2.6K views36 slides
BlueHat v18 || Return of the kernel rootkit malware (on windows 10) by
BlueHat v18 || Return of the kernel rootkit malware (on windows 10)BlueHat v18 || Return of the kernel rootkit malware (on windows 10)
BlueHat v18 || Return of the kernel rootkit malware (on windows 10)BlueHat Security Conference
5.4K views58 slides
Crisis. advanced malware by
Crisis. advanced malwareCrisis. advanced malware
Crisis. advanced malwareYury Chemerkin
563 views14 slides
SANS Digital Forensics and Incident Response Poster 2012 by
SANS Digital Forensics and Incident Response Poster 2012SANS Digital Forensics and Incident Response Poster 2012
SANS Digital Forensics and Incident Response Poster 2012Rian Yulian
3.1K views1 slide
Reversing & malware analysis training part 9 advanced malware analysis by
Reversing & malware analysis training part 9   advanced malware analysisReversing & malware analysis training part 9   advanced malware analysis
Reversing & malware analysis training part 9 advanced malware analysisAbdulrahman Bassam
1K views45 slides
Stuxnet dc9723 by
Stuxnet dc9723Stuxnet dc9723
Stuxnet dc9723Iftach Ian Amit
7.8K views38 slides
Reversing malware analysis trainingpart9 advanced malware analysis by
Reversing malware analysis trainingpart9 advanced malware analysisReversing malware analysis trainingpart9 advanced malware analysis
Reversing malware analysis trainingpart9 advanced malware analysisCysinfo Cyber Security Community
631 views43 slides
HoneyNet SOTM 32 - Windows Malware Analysis by
HoneyNet SOTM 32 - Windows Malware AnalysisHoneyNet SOTM 32 - Windows Malware Analysis
HoneyNet SOTM 32 - Windows Malware AnalysisChetan Ganatra
36 views17 slides
Windows Threat Hunting by
Windows Threat HuntingWindows Threat Hunting
Windows Threat HuntingGIBIN JOHN
1.4K views17 slides
UEFI Firmware Rootkits: Myths and Reality by
UEFI Firmware Rootkits: Myths and RealityUEFI Firmware Rootkits: Myths and Reality
UEFI Firmware Rootkits: Myths and RealitySally Feller
992 views95 slides
Kunal - Introduction to BackTrack - ClubHack2008 by
Kunal - Introduction to BackTrack - ClubHack2008Kunal - Introduction to BackTrack - ClubHack2008
Kunal - Introduction to BackTrack - ClubHack2008ClubHack
412 views25 slides
[CB20] Operation I am Tom: How APT actors move laterally in corporate network... by
[CB20] Operation I am Tom: How APT actors move laterally in corporate network...[CB20] Operation I am Tom: How APT actors move laterally in corporate network...
[CB20] Operation I am Tom: How APT actors move laterally in corporate network...CODE BLUE
221 views63 slides
Metasploit Framework Executable Encoding by
Metasploit Framework Executable EncodingMetasploit Framework Executable Encoding
Metasploit Framework Executable Encodingtechnology_flow
1.1K views23 slides

Similar to Black Energy18 - Russian botnet package analysis (20)

Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis by securityxploded
Reversing & Malware Analysis Training Part 9 -  Advanced Malware AnalysisReversing & Malware Analysis Training Part 9 -  Advanced Malware Analysis
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
securityxploded9.5K views
Two-For-One Talk: Malware Analysis for Everyone by Paul Melson
Two-For-One Talk: Malware Analysis for EveryoneTwo-For-One Talk: Malware Analysis for Everyone
Two-For-One Talk: Malware Analysis for Everyone
Paul Melson1.9K views
Cyber Defense Forensic Analyst - Real World Hands-on Examples by Sandeep Kumar Seeram
Cyber Defense Forensic Analyst - Real World Hands-on ExamplesCyber Defense Forensic Analyst - Real World Hands-on Examples
Cyber Defense Forensic Analyst - Real World Hands-on Examples
Pursue the Attackers – Identify and Investigate Lateral Movement Based on Beh... by CODE BLUE
Pursue the Attackers – Identify and Investigate Lateral Movement Based on Beh...Pursue the Attackers – Identify and Investigate Lateral Movement Based on Beh...
Pursue the Attackers – Identify and Investigate Lateral Movement Based on Beh...
CODE BLUE1.4K views
Malware analysis by Den Iir
Malware analysisMalware analysis
Malware analysis
Den Iir386 views
Intrusion Discovery on Windows by dkaya
Intrusion Discovery on WindowsIntrusion Discovery on Windows
Intrusion Discovery on Windows
dkaya734 views
Malware Analysis Made Simple by Paul Melson
Malware Analysis Made SimpleMalware Analysis Made Simple
Malware Analysis Made Simple
Paul Melson2.6K views
SANS Digital Forensics and Incident Response Poster 2012 by Rian Yulian
SANS Digital Forensics and Incident Response Poster 2012SANS Digital Forensics and Incident Response Poster 2012
SANS Digital Forensics and Incident Response Poster 2012
Rian Yulian3.1K views
Reversing & malware analysis training part 9 advanced malware analysis by Abdulrahman Bassam
Reversing & malware analysis training part 9   advanced malware analysisReversing & malware analysis training part 9   advanced malware analysis
Reversing & malware analysis training part 9 advanced malware analysis
HoneyNet SOTM 32 - Windows Malware Analysis by Chetan Ganatra
HoneyNet SOTM 32 - Windows Malware AnalysisHoneyNet SOTM 32 - Windows Malware Analysis
HoneyNet SOTM 32 - Windows Malware Analysis
Chetan Ganatra36 views
Windows Threat Hunting by GIBIN JOHN
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
GIBIN JOHN1.4K views
UEFI Firmware Rootkits: Myths and Reality by Sally Feller
UEFI Firmware Rootkits: Myths and RealityUEFI Firmware Rootkits: Myths and Reality
UEFI Firmware Rootkits: Myths and Reality
Sally Feller992 views
Kunal - Introduction to BackTrack - ClubHack2008 by ClubHack
Kunal - Introduction to BackTrack - ClubHack2008Kunal - Introduction to BackTrack - ClubHack2008
Kunal - Introduction to BackTrack - ClubHack2008
ClubHack412 views
[CB20] Operation I am Tom: How APT actors move laterally in corporate network... by CODE BLUE
[CB20] Operation I am Tom: How APT actors move laterally in corporate network...[CB20] Operation I am Tom: How APT actors move laterally in corporate network...
[CB20] Operation I am Tom: How APT actors move laterally in corporate network...
CODE BLUE221 views
Metasploit Framework Executable Encoding by technology_flow
Metasploit Framework Executable EncodingMetasploit Framework Executable Encoding
Metasploit Framework Executable Encoding
technology_flow1.1K views

More from Roberto Suggi Liverani

I got 99 trends and a # is all of them by
I got 99 trends and a # is all of themI got 99 trends and a # is all of them
I got 99 trends and a # is all of themRoberto Suggi Liverani
5.8K views122 slides
Augmented reality in your web proxy by
Augmented reality in your web proxyAugmented reality in your web proxy
Augmented reality in your web proxyRoberto Suggi Liverani
3.3K views39 slides
Cross Context Scripting attacks & exploitation by
Cross Context Scripting attacks & exploitationCross Context Scripting attacks & exploitation
Cross Context Scripting attacks & exploitationRoberto Suggi Liverani
3.5K views69 slides
Window Shopping Browser - Bug Hunting in 2012 by
Window Shopping Browser - Bug Hunting in 2012Window Shopping Browser - Bug Hunting in 2012
Window Shopping Browser - Bug Hunting in 2012Roberto Suggi Liverani
3.1K views56 slides
None More Black - the Dark Side of SEO by
None More Black - the Dark Side of SEONone More Black - the Dark Side of SEO
None More Black - the Dark Side of SEORoberto Suggi Liverani
21K views58 slides
Bridging the gap - Security and Software Testing by
Bridging the gap - Security and Software TestingBridging the gap - Security and Software Testing
Bridging the gap - Security and Software TestingRoberto Suggi Liverani
1.2K views31 slides
Defending Against Application DoS attacks by
Defending Against Application DoS attacksDefending Against Application DoS attacks
Defending Against Application DoS attacksRoberto Suggi Liverani
5.1K views51 slides
Exploiting Firefox Extensions by
Exploiting Firefox ExtensionsExploiting Firefox Extensions
Exploiting Firefox ExtensionsRoberto Suggi Liverani
3.5K views42 slides
XPath Injection by
XPath InjectionXPath Injection
XPath InjectionRoberto Suggi Liverani
7.1K views23 slides
Web Spam Techniques by
Web Spam TechniquesWeb Spam Techniques
Web Spam TechniquesRoberto Suggi Liverani
78.8K views53 slides
Reversing JavaScript by
Reversing JavaScriptReversing JavaScript
Reversing JavaScriptRoberto Suggi Liverani
2.9K views48 slides
Ajax Security by
Ajax SecurityAjax Security
Ajax SecurityRoberto Suggi Liverani
2K views33 slides
Browser Security by
Browser SecurityBrowser Security
Browser SecurityRoberto Suggi Liverani
16.4K views28 slides

More from Roberto Suggi Liverani (13)

Recently uploaded

Network eWaste : Community role to manage end of life Product by
Network eWaste : Community role to manage end of life ProductNetwork eWaste : Community role to manage end of life Product
Network eWaste : Community role to manage end of life ProductBangladesh Network Operators Group
26 views13 slides
Digital Personal Data Protection (DPDP) Practical Approach For CISOs by
Digital Personal Data Protection (DPDP) Practical Approach For CISOsDigital Personal Data Protection (DPDP) Practical Approach For CISOs
Digital Personal Data Protection (DPDP) Practical Approach For CISOsPriyanka Aash
187 views59 slides
Building a Strong Data Governance Framework for DevOps | Software Development... by
Building a Strong Data Governance Framework for DevOps | Software Development...Building a Strong Data Governance Framework for DevOps | Software Development...
Building a Strong Data Governance Framework for DevOps | Software Development...Dieter Ziegler
20 views7 slides
Xavier M Culmination Presenetation Final 12-7.pptx by
Xavier M Culmination Presenetation Final 12-7.pptxXavier M Culmination Presenetation Final 12-7.pptx
Xavier M Culmination Presenetation Final 12-7.pptxmanzanaresxavier28
43 views10 slides
Data Mesh using Microsoft Fabric by
Data Mesh using Microsoft FabricData Mesh using Microsoft Fabric
Data Mesh using Microsoft FabricNathan Bijnens
76 views32 slides
AI + Memoori = AIM by
AI + Memoori = AIMAI + Memoori = AIM
AI + Memoori = AIMMemoori
41 views9 slides
[2024] GDSC India - Discover, Design, Develop.pdf.pdf by
[2024] GDSC India - Discover, Design, Develop.pdf.pdf[2024] GDSC India - Discover, Design, Develop.pdf.pdf
[2024] GDSC India - Discover, Design, Develop.pdf.pdfbcedsc
28 views19 slides
This talk was not generated with ChatGPT: how AI is changing science by
This talk was not generated with ChatGPT: how AI is changing scienceThis talk was not generated with ChatGPT: how AI is changing science
This talk was not generated with ChatGPT: how AI is changing scienceElena Simperl
44 views13 slides
Measuring User on the web with the core web vitals - by @theafolayan.pptx by
Measuring User on the web with the core web vitals - by @theafolayan.pptxMeasuring User on the web with the core web vitals - by @theafolayan.pptx
Measuring User on the web with the core web vitals - by @theafolayan.pptxOluwaseun Raphael Afolayan
15 views13 slides
Redefining the book supply chain: A glimpse into the future - Tech Forum 2023 by
Redefining the book supply chain: A glimpse into the future - Tech Forum 2023Redefining the book supply chain: A glimpse into the future - Tech Forum 2023
Redefining the book supply chain: A glimpse into the future - Tech Forum 2023BookNet Canada
57 views19 slides
Bronack Skills - Risk Management and SRE v1.0 12-10-2023.pdf by
Bronack Skills - Risk Management and SRE v1.0 12-10-2023.pdfBronack Skills - Risk Management and SRE v1.0 12-10-2023.pdf
Bronack Skills - Risk Management and SRE v1.0 12-10-2023.pdfThomasBronack
29 views32 slides
Initiating and Advancing Your Strategic GIS Governance Strategy by
Initiating and Advancing Your Strategic GIS Governance StrategyInitiating and Advancing Your Strategic GIS Governance Strategy
Initiating and Advancing Your Strategic GIS Governance StrategySafe Software
280 views68 slides
Business Analyst Series 2023 - Week 4 Session 8 by
Business Analyst Series 2023 -  Week 4 Session 8Business Analyst Series 2023 -  Week 4 Session 8
Business Analyst Series 2023 - Week 4 Session 8DianaGray10
238 views13 slides
Qualifying SaaS, IaaS.pptx by
Qualifying SaaS, IaaS.pptxQualifying SaaS, IaaS.pptx
Qualifying SaaS, IaaS.pptxSachin Bhandari
1.2K views8 slides
What is Authentication Active Directory_.pptx by
What is Authentication Active Directory_.pptxWhat is Authentication Active Directory_.pptx
What is Authentication Active Directory_.pptxHeenaMehta35
31 views7 slides
Cocktail of Environments. How to Mix Test and Development Environments and St... by
Cocktail of Environments. How to Mix Test and Development Environments and St...Cocktail of Environments. How to Mix Test and Development Environments and St...
Cocktail of Environments. How to Mix Test and Development Environments and St...Aleksandr Tarasov
27 views135 slides
Business Analyst Series 2023 - Week 5 Session 9 by
Business Analyst Series 2023 -  Week 5 Session 9Business Analyst Series 2023 -  Week 5 Session 9
Business Analyst Series 2023 - Week 5 Session 9DianaGray10
109 views13 slides
Enabling DPU Hardware Accelerators in XCP-ng Cloud Platform Environment - And... by
Enabling DPU Hardware Accelerators in XCP-ng Cloud Platform Environment - And...Enabling DPU Hardware Accelerators in XCP-ng Cloud Platform Environment - And...
Enabling DPU Hardware Accelerators in XCP-ng Cloud Platform Environment - And...ShapeBlue
166 views12 slides
Mobile Core Solutions & Successful Cases.pdf by
Mobile Core Solutions & Successful Cases.pdfMobile Core Solutions & Successful Cases.pdf
Mobile Core Solutions & Successful Cases.pdfIPLOOK Networks
20 views7 slides
User Centred Design and Implementation of Useful Picture Archiving and Commun... by
User Centred Design and Implementation of Useful Picture Archiving and Commun...User Centred Design and Implementation of Useful Picture Archiving and Commun...
User Centred Design and Implementation of Useful Picture Archiving and Commun...Lighton Phiri
24 views26 slides

Recently uploaded (20)

Digital Personal Data Protection (DPDP) Practical Approach For CISOs by Priyanka Aash
Digital Personal Data Protection (DPDP) Practical Approach For CISOsDigital Personal Data Protection (DPDP) Practical Approach For CISOs
Digital Personal Data Protection (DPDP) Practical Approach For CISOs
Priyanka Aash187 views
Building a Strong Data Governance Framework for DevOps | Software Development... by Dieter Ziegler
Building a Strong Data Governance Framework for DevOps | Software Development...Building a Strong Data Governance Framework for DevOps | Software Development...
Building a Strong Data Governance Framework for DevOps | Software Development...
Dieter Ziegler20 views
Xavier M Culmination Presenetation Final 12-7.pptx by manzanaresxavier28
Xavier M Culmination Presenetation Final 12-7.pptxXavier M Culmination Presenetation Final 12-7.pptx
Xavier M Culmination Presenetation Final 12-7.pptx
Data Mesh using Microsoft Fabric by Nathan Bijnens
Data Mesh using Microsoft FabricData Mesh using Microsoft Fabric
Data Mesh using Microsoft Fabric
Nathan Bijnens76 views
AI + Memoori = AIM by Memoori
AI + Memoori = AIMAI + Memoori = AIM
AI + Memoori = AIM
Memoori41 views
[2024] GDSC India - Discover, Design, Develop.pdf.pdf by bcedsc
[2024] GDSC India - Discover, Design, Develop.pdf.pdf[2024] GDSC India - Discover, Design, Develop.pdf.pdf
[2024] GDSC India - Discover, Design, Develop.pdf.pdf
bcedsc28 views
This talk was not generated with ChatGPT: how AI is changing science by Elena Simperl
This talk was not generated with ChatGPT: how AI is changing scienceThis talk was not generated with ChatGPT: how AI is changing science
This talk was not generated with ChatGPT: how AI is changing science
Elena Simperl44 views
Redefining the book supply chain: A glimpse into the future - Tech Forum 2023 by BookNet Canada
Redefining the book supply chain: A glimpse into the future - Tech Forum 2023Redefining the book supply chain: A glimpse into the future - Tech Forum 2023
Redefining the book supply chain: A glimpse into the future - Tech Forum 2023
BookNet Canada57 views
Bronack Skills - Risk Management and SRE v1.0 12-10-2023.pdf by ThomasBronack
Bronack Skills - Risk Management and SRE v1.0 12-10-2023.pdfBronack Skills - Risk Management and SRE v1.0 12-10-2023.pdf
Bronack Skills - Risk Management and SRE v1.0 12-10-2023.pdf
ThomasBronack29 views
Initiating and Advancing Your Strategic GIS Governance Strategy by Safe Software
Initiating and Advancing Your Strategic GIS Governance StrategyInitiating and Advancing Your Strategic GIS Governance Strategy
Initiating and Advancing Your Strategic GIS Governance Strategy
Safe Software280 views
Business Analyst Series 2023 - Week 4 Session 8 by DianaGray10
Business Analyst Series 2023 -  Week 4 Session 8Business Analyst Series 2023 -  Week 4 Session 8
Business Analyst Series 2023 - Week 4 Session 8
DianaGray10238 views
What is Authentication Active Directory_.pptx by HeenaMehta35
What is Authentication Active Directory_.pptxWhat is Authentication Active Directory_.pptx
What is Authentication Active Directory_.pptx
HeenaMehta3531 views
Cocktail of Environments. How to Mix Test and Development Environments and St... by Aleksandr Tarasov
Cocktail of Environments. How to Mix Test and Development Environments and St...Cocktail of Environments. How to Mix Test and Development Environments and St...
Cocktail of Environments. How to Mix Test and Development Environments and St...
Business Analyst Series 2023 - Week 5 Session 9 by DianaGray10
Business Analyst Series 2023 -  Week 5 Session 9Business Analyst Series 2023 -  Week 5 Session 9
Business Analyst Series 2023 - Week 5 Session 9
DianaGray10109 views
Enabling DPU Hardware Accelerators in XCP-ng Cloud Platform Environment - And... by ShapeBlue
Enabling DPU Hardware Accelerators in XCP-ng Cloud Platform Environment - And...Enabling DPU Hardware Accelerators in XCP-ng Cloud Platform Environment - And...
Enabling DPU Hardware Accelerators in XCP-ng Cloud Platform Environment - And...
ShapeBlue166 views
Mobile Core Solutions & Successful Cases.pdf by IPLOOK Networks
Mobile Core Solutions & Successful Cases.pdfMobile Core Solutions & Successful Cases.pdf
Mobile Core Solutions & Successful Cases.pdf
IPLOOK Networks20 views
User Centred Design and Implementation of Useful Picture Archiving and Commun... by Lighton Phiri
User Centred Design and Implementation of Useful Picture Archiving and Commun...User Centred Design and Implementation of Useful Picture Archiving and Commun...
User Centred Design and Implementation of Useful Picture Archiving and Commun...
Lighton Phiri24 views

Black Energy18 - Russian botnet package analysis

  • 1. © 2008 Security-Assessment.com Black Energy 1.8 Russian web-based botnet package analysis Presented By Roberto Suggi Liverani
  • 2.
  • 3.
  • 4.
  • 5.
  • 6.
  • 7.
  • 8.
  • 9.
  • 10.
  • 11.
  • 12.
  • 13.
  • 14.
  • 15.
  • 16.
  • 17.
  • 18.
  • 19.
  • 20.
  • 21.
  • 22.
  • 23.
  • 24.
  • 25.
  • 26.
  • 27.
  • 28.
  • 29.
  • 30.
  • 31.
  • 32.
  • 33.
  • 34.
  • 35.
  • 36.
  • 37.
  • 38.
  • 39.
  • 40.
  • 41.
  • 42.
  • 43.
  • 44.
  • 45.
  • 46. Questions? © 2007 Security-Assessment.com http://www.security-assessment.com [email_address]
  • 47.
  • 48.