SlideShare a Scribd company logo

Intro2 malwareanalysisshort

•
•
Vincent Ohprecio
Vincent Ohprecio

Presentation IT4BC 2011

Technology
1 of 172
Security and Privacy Track Session 1
Introduction to Malware Analysis Vincent = Big O
What do they have in common? Lindsay Lohan Paris Hilton Snooki Charlie Sheen
Jail
Albert Gonzales Hacked Wireless Network TJ Maxx 90 Million Credit Cards 20 Years in Jail
Hacking = Jail
Motivation?
Bad Guys Motivated by money New school bad guys are after your electronic wallet Take over payment systems Take over the world Just like Doctor Evil
About Me Work at Capilano University Hack wet paper bags for a living I live in Vancouver I commute by bike I love 80’s music I love Backtrack4
I love my mac
My Reading List NIST Windows Forensics Analysis Reverse Engineering The Rootkit Arsenal Security Power Tools Google Youtube DFWS
My Favorite Hacker Cons DEFCON CanSecWest SecTor Blackhat CCC
Click Happy! and proud of it.
What is Malware Analysis?
What is Malware Analysis? Like being in science class in high school For example studying a worm Used microscope Draw picture or diagram of worm Observed worm before dissection
Introduction to Malware Analysis
Purpose Tapas Small taste of everything For malware analysis
What is Malware?
Malware Short for malicious program Program designed to alter the flow of the program Designed with malicious intent Gain access to systems Used to gather information, usually without permission of owner
When I was younger… Used to deliver malware via floppy disks My favorite piece of malware was Sub7
Threat Report
Symantec Internet Security Threat Report Released April 2011 For the year of 2010 Pdf download Outlines trends for malware, virus and worms
How do you get infected? Drive by Download Phishing scams Malicious Email attachments Bogus Downloads SQL Injected Websites
Examples of Malware
Lisa Moon Visited Capilano University Over 5 Million sites infected SQL injection php webpages Redirected to malware sites
Fake AV Java Applet Active X EXE download
Attack Toolkits
Zeus (Zbot)
Zeus The most notorious and widely-spread information stealing Trojans in existence Targets financial data theft Lead to the loss of millions worldwide
Crimeware Toolkit Zeus is a toolkit that provides a malware creator all of the tools required to build and administer a botnet Zeus tools are primarily designed for stealing banking information Zeus can easily be used for other types of data or identity theft
Controllers of ZBOT Capture (banking) credentials Remote control Keystroke logging Screen capture Proxy services Spamming
Zeus Builder This page is where you create your bot executables Once created, you are responsible for distribution Go find some victims
Zeus Configuration The bot needs a configuration to tell it which address to send all the stolen data What’s the use of misconfiguring a botnet that can’t send you stolen data?
Configuration Screens
Communications Communications pass between the bots and one or more servers Command and Control Server is used to distribute bot file updates
Communications Data is encrypted with RC4 encryption A password is used to encrypt all data that is passed through the botnet
Zeus Install Behavior
Zeus Flow Copy itself to another location, execute the copy, delete the original Lowers browser security settings by changing IE registry entries Injects code into other processes, main process exits
Zeus - Flow Injected code hooks APIs in each process Steals several different type of credential found on the system
Zeus - Flow Downloads config file and processes it Uses API hooks to steal data Sends data back to C&C
http://zeustracker.abuse.ch
Typical Theft Attackers steal credentials Set up bogus employee/vendor accounts Accounts are actually “mules” Transfers typically kept under $10K
Wire Money Eastern Europe
WANTED
Finding Mules Recruited job websites Receive instructions via website Process Payments Laundry via purchases Write proper phishing emails
Zeus characteristics Continuously changing, software gets routinely updated Strong encryption used in program of various functions to hide secrets Software uses packers and unpackers Anti-virus evasion techniques used
Big Picture
Kung Fu Skillz Code breaking Puzzle solving Programming Logical analysis
Kung Fu Build analysis workstation Behavior and Code Analysis Reverse Engineer Virus Total
Click Happy Fun ( ) Fundamental aspects of malware analysis Setup an inexpensive and flexible laboratory Use lab for exploring characteristics of real-world malware
Build Workstation Install Base OS Install vmware Install victim OS Install monitoring tools
Build Workstation Install Base OS Install vmware Install victim OS Install monitoring tools
Build Workstation Install Base OS Install vmware Install victim OS Install monitoring tools
Build Workstation Install Base OS Install vmware Install Victim OS Install monitoring tools
Build Workstation Install Base OS Install vmware Install victim OS Install monitoring tools
Tools PSTools from SysInternals IDA Pro Wireshark Anti-virus
Other Tools Fake DNS and shellcode2exe LordPE, and PEiD Malzilla, and SpiderMonkey Firefox, No Script, BurpSuite Honeyd, NetCat, curl, wget, Volatility Framework and plug-ins such as malfind2 FTK Imager
Kung Fu Build analysis workstation Behavior and Code Analysis Reverse Engineer Virus Total
Assumption
Getting evidence Gathering electronic evidence Evidence process Access Data FTK – Used to solve Lacie Peterson Case
RSA Hacked
Timeline Phishing – Zero Day Attack Backdoor installed Lateral Movement Data Gathering Exfiltrate
How do you know you have a virus or malware?
You can rely on… Your anti-virus vendor Web or malware gateway Network analysis tools
Rootkit Revealer Rootkit detection utility Lists Registry and file system API discrepancies Helps indicate the presence of a user-mode or kernel-mode rootkits
Behavior and Code Analysis Two approaches
Answer these questions! Process count User ID's Loaded Modules Files Registry Keys
Answer this! DLL Used API hooked Memory Space Used Network Connections Services Used Sockets Used
Temporal Reconstruction
Temporal Reconstruction Forensic analysis to reconstruct events surrounding a hacking incident or malware infection Dead machine and Live System Analysis AKA = Building a Timeline NOTE : Live Analysis means data is volatile
MACtime forensic tool in your digital detective toolkit Unix and Linux mtime, atime, and ctime Windows LastWriteTime, LastAccessTime, and CreationTime
Build a Timeline
Timeline Analysis File system metadata Event Log entries Data from the Registry User's web browser history Timestamps Network Statistics Logs
Timestamps Creation Date Last Modified Date Last Accessed Date Last Modified Date for the file's Master File Table (MFT) entry
File Carving Tool for recovering files and fragments of files when directory entries are corrupt or missing For example – listing directory of pictures Pictures are all deleted in the catalogue File Carving allows investigator to recover pictures without directory listings
Finding Hidden exe
LordPE
Hiding Process Backtrack4 Linux Distribution Rooted box with Metasploit Migrated process via meterpreter script
Extracting exe
Volatility Python Scripts
Volatility Digital Forensics Utility Script used to walk memory dumps Rebuild running processes Rebuild executables Malfind plug-in finds suspicious files in memory
Malicious process hidden in PID 4968
VAD Walk identifies offsets
Disassembly of offsets
VAD Walk Virtual Address Descriptor (VAD) tree structure in Windows memory dumps Method to locate and parse the structure of physical memory Method walks the tree for the “hacked” process
Using Foremost to get EXE
NetworkMiner
Using Wireshark Capture packs on network of malware contacting Zeus Command and Control Behavior based analysis of malware
Analysis with NetworkMiner Need pcap file Need download NetworkMiner Need search criteria
Network
Click Happy – Infect your system Set up your process viewers Snapshot your registry with Regshot Configure FakeDNS Start Wireshark Double Click that Executable Intercept system and network-level activities in the analysis lab
NOTE MAKE SURE YOU DON’T CONNECT TO PROD
Kung Fu Build analysis workstation Behavior and Code Analysis Reverse Engineer Virus Total
What is reverse engineering?
Reverse engineering is the process of analyzing a subject to create representations of the system at a higher level of abstraction
Understanding 1 and 0’s Software person programs in language Program gets compiled 1’s and 0’s get “translated” from human readable code to machine instruction Reverse Engineering attempts to take machine instruction and create human readable code
Compiling Source Code Source Code Compiler Object File
Object File DLL DLL Linker
Assembly Language
Example Assembly MOV AX, 47104 MOV DS, AX MOV [3998], 36 INT 32 Each line is one CPU-level instruction
Example Assembly MOV AX, 47104 MOV DS, AX MOV [3998], 36 INT 32 Tells the computer to copy the number 47104 into the location AX
Human readable
Example Human Readable #include <stdio.h> int main() { printf( “Click Happy.n" ); getchar(); return 0; }
Purpose of R.E. Manually follow flow of program visually using graphs Manually follow flow of program reading the code Execute code with breakpoints to control the flow of the program during runtime Look for hints or clues to origin, signatures, or programming style Look for characteristics of program
Reverse-Engineering Benefits Sophisticated malware protects itself from discovery and analysis Malware will have passwords, backdoor, and secret methods to hide and protect information Allows analyst to discover great detail on the operations and flow control of the program
Wouldn’t it be nice to have the login and password to the Command and Control Server of a BotNet?
Manual unpacking of protected malicious Windows executables
Understand anti-analysis mechanisms built into malware
Analyzing protected malicious browser scripts written in JavaScript and VBScript
Other Benefits of R.E. Performing static and dynamic code analysis of malicious Windows executables Step through code using debuggers like OllyDbg or SoftICE
OllyDbg 32-bit assembler level debugger Binary code analysis where source is unavailable
Using OllyDbg Drag executable onto OllyDbg “Step into” each instruction until something fun happens In the register section you can observe what is being run in memory
Reverse Engineering Potentially gives you the “why” of the behavior Insight into the inner workings of the program
BinText Searches Binary or Executable for all Text Outputs “strings” Provides insight to structure or parts of the program
Searching strings Analyzing malware with IDA Pro and strings
Kung Fu Build analysis workstation Behavior and Code Analysis Reverse Engineer Virus Total
Virus Total
CWSandbox
Final Thoughts
got root?
APT? Advanced Persistent Threat Threat, such as a foreign nation state government, with both the capability and the intent to persistently and effectively target a specific entity
Coordinated human involvement NOT mindless and automated piece of code Specific objective Skilled and motivated Organized and well funded
Photo Credits = Internet
Thank you!  </end>
Quiz
What are the two types of malware analysis?
Behavioral Analysis Code Analysis
What is APT?
Advanced Persistent Threat
What is reverse engineering?
Reverse engineering is the process of analyzing a subject system to create representations of the system at a higher level of abstraction
How many PC’s deployed worldwide?
1.2 Billion
How many smartphones? What’s the future market?
5 Billion
What does hacking get you?
New friends
Place to stay. 3 meals.
Job Retraining
Hacking = Jail
Click Happy. Thank you!

Recommended

Introduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse EngineeringIntroduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse Engineeringintertelinvestigations
 
Hunting rootkit from dark corners of memory
Hunting rootkit from dark corners of memoryHunting rootkit from dark corners of memory
Hunting rootkit from dark corners of memoryCysinfo Cyber Security Community
 
Information security & EthicalHacking
Information security & EthicalHackingInformation security & EthicalHacking
Information security & EthicalHackingAve Nawsh
 
Basic malware analysis
Basic malware analysis Basic malware analysis
Basic malware analysis Cysinfo Cyber Security Community
 
Malware classification and detection
Malware classification and detectionMalware classification and detection
Malware classification and detectionChong-Kuan Chen
 
Op Sy 03 Ch 61
Op Sy 03 Ch 61Op Sy 03 Ch 61
Op Sy 03 Ch 61 Google
 
Chapter 09
Chapter 09Chapter 09
Chapter 09 Google
 
Investigating Malware using Memory Forensics
Investigating Malware using Memory ForensicsInvestigating Malware using Memory Forensics
Investigating Malware using Memory ForensicsCysinfo Cyber Security Community
 

Recommended

Introduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse EngineeringIntroduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse Engineeringintertelinvestigations
 
Hunting rootkit from dark corners of memory
Hunting rootkit from dark corners of memoryHunting rootkit from dark corners of memory
Hunting rootkit from dark corners of memoryCysinfo Cyber Security Community
 
Information security & EthicalHacking
Information security & EthicalHackingInformation security & EthicalHacking
Information security & EthicalHackingAve Nawsh
 
Basic malware analysis
Basic malware analysis Basic malware analysis
Basic malware analysis Cysinfo Cyber Security Community
 
Malware classification and detection
Malware classification and detectionMalware classification and detection
Malware classification and detectionChong-Kuan Chen
 
Op Sy 03 Ch 61
Op Sy 03 Ch 61Op Sy 03 Ch 61
Op Sy 03 Ch 61 Google
 
Chapter 09
Chapter 09Chapter 09
Chapter 09 Google
 
Investigating Malware using Memory Forensics
Investigating Malware using Memory ForensicsInvestigating Malware using Memory Forensics
Investigating Malware using Memory ForensicsCysinfo Cyber Security Community
 
SANS Digital Forensics and Incident Response Poster 2012
SANS Digital Forensics and Incident Response Poster 2012SANS Digital Forensics and Incident Response Poster 2012
SANS Digital Forensics and Incident Response Poster 2012Rian Yulian
 
Return Address – The Silver Bullet
Return Address – The Silver BulletReturn Address – The Silver Bullet
Return Address – The Silver Bulletsecurityxploded
 
Automating malware analysis
Automating malware analysis Automating malware analysis
Automating malware analysis Cysinfo Cyber Security Community
 
Malware Classification Using Structured Control Flow
Malware Classification Using Structured Control FlowMalware Classification Using Structured Control Flow
Malware Classification Using Structured Control FlowSilvio Cesare
 
Android malware presentation
Android malware presentationAndroid malware presentation
Android malware presentationSandeep Joshi
 
The Future of Automated Malware Generation
The Future of Automated Malware GenerationThe Future of Automated Malware Generation
The Future of Automated Malware GenerationStephan Chenette
 
Reverse engineering malware
Reverse engineering malwareReverse engineering malware
Reverse engineering malwareCysinfo Cyber Security Community
 
Ceh v8 labs module 03 scanning networks
Ceh v8 labs module 03 scanning networksCeh v8 labs module 03 scanning networks
Ceh v8 labs module 03 scanning networksAsep Sopyan
 
CarolinaCon 2008 Rootkits Then and Now
CarolinaCon 2008 Rootkits Then and NowCarolinaCon 2008 Rootkits Then and Now
CarolinaCon 2008 Rootkits Then and NowTyler Shields
 
Reconnaissance & Scanning
Reconnaissance & ScanningReconnaissance & Scanning
Reconnaissance & Scanningamiable_indian
 
Watchtowers of the Internet - Source Boston 2012
Watchtowers of the Internet - Source Boston 2012Watchtowers of the Internet - Source Boston 2012
Watchtowers of the Internet - Source Boston 2012Stephan Chenette
 
Digital Immunity -The Myths and Reality
Digital Immunity -The Myths and RealityDigital Immunity -The Myths and Reality
Digital Immunity -The Myths and Realityamiable_indian
 
Reverse Engineering Malware
Reverse Engineering MalwareReverse Engineering Malware
Reverse Engineering Malwaresecurityxploded
 
Ceh v8 labs module 07 viruses and worms
Ceh v8 labs module 07 viruses and wormsCeh v8 labs module 07 viruses and worms
Ceh v8 labs module 07 viruses and wormsAsep Sopyan
 
Analysis Of Adverarial Code - The Role of Malware Kits
Analysis Of Adverarial Code - The Role of Malware KitsAnalysis Of Adverarial Code - The Role of Malware Kits
Analysis Of Adverarial Code - The Role of Malware KitsRahul Mohandas
 
Ceh v8 labs module 05 system hacking
Ceh v8 labs module 05 system hackingCeh v8 labs module 05 system hacking
Ceh v8 labs module 05 system hackingAsep Sopyan
 
Ceh v8 labs module 10 denial of service
Ceh v8 labs module 10 denial of serviceCeh v8 labs module 10 denial of service
Ceh v8 labs module 10 denial of serviceAsep Sopyan
 
Catching fileless attacks
Catching fileless attacksCatching fileless attacks
Catching fileless attacksBalaji Rajasekaran
 
Introduction to trojans and backdoors
Introduction to trojans and backdoorsIntroduction to trojans and backdoors
Introduction to trojans and backdoorsjibinmanjooran
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentTeymur Kheirkhabarov
 
Ceh certified ethical hacker
Ceh certified ethical hackerCeh certified ethical hacker
Ceh certified ethical hackerbestip
 
Malware and Anti-Malware Seminar by Benny Czarny
Malware and Anti-Malware Seminar by Benny CzarnyMalware and Anti-Malware Seminar by Benny Czarny
Malware and Anti-Malware Seminar by Benny CzarnyOPSWAT
 

More Related Content

What's hot

SANS Digital Forensics and Incident Response Poster 2012
SANS Digital Forensics and Incident Response Poster 2012SANS Digital Forensics and Incident Response Poster 2012
SANS Digital Forensics and Incident Response Poster 2012Rian Yulian
 
Return Address – The Silver Bullet
Return Address – The Silver BulletReturn Address – The Silver Bullet
Return Address – The Silver Bulletsecurityxploded
 
Malware Classification Using Structured Control Flow
Malware Classification Using Structured Control FlowMalware Classification Using Structured Control Flow
Malware Classification Using Structured Control FlowSilvio Cesare
 
Android malware presentation
Android malware presentationAndroid malware presentation
Android malware presentationSandeep Joshi
 
The Future of Automated Malware Generation
The Future of Automated Malware GenerationThe Future of Automated Malware Generation
The Future of Automated Malware GenerationStephan Chenette
 
Ceh v8 labs module 03 scanning networks
Ceh v8 labs module 03 scanning networksCeh v8 labs module 03 scanning networks
Ceh v8 labs module 03 scanning networksAsep Sopyan
 
CarolinaCon 2008 Rootkits Then and Now
CarolinaCon 2008 Rootkits Then and NowCarolinaCon 2008 Rootkits Then and Now
CarolinaCon 2008 Rootkits Then and NowTyler Shields
 
Reconnaissance & Scanning
Reconnaissance & ScanningReconnaissance & Scanning
Reconnaissance & Scanningamiable_indian
 
Watchtowers of the Internet - Source Boston 2012
Watchtowers of the Internet - Source Boston 2012Watchtowers of the Internet - Source Boston 2012
Watchtowers of the Internet - Source Boston 2012Stephan Chenette
 
Digital Immunity -The Myths and Reality
Digital Immunity -The Myths and RealityDigital Immunity -The Myths and Reality
Digital Immunity -The Myths and Realityamiable_indian
 
Reverse Engineering Malware
Reverse Engineering MalwareReverse Engineering Malware
Reverse Engineering Malwaresecurityxploded
 
Ceh v8 labs module 07 viruses and worms
Ceh v8 labs module 07 viruses and wormsCeh v8 labs module 07 viruses and worms
Ceh v8 labs module 07 viruses and wormsAsep Sopyan
 
Analysis Of Adverarial Code - The Role of Malware Kits
Analysis Of Adverarial Code - The Role of Malware KitsAnalysis Of Adverarial Code - The Role of Malware Kits
Analysis Of Adverarial Code - The Role of Malware KitsRahul Mohandas
 
Ceh v8 labs module 05 system hacking
Ceh v8 labs module 05 system hackingCeh v8 labs module 05 system hacking
Ceh v8 labs module 05 system hackingAsep Sopyan
 
Ceh v8 labs module 10 denial of service
Ceh v8 labs module 10 denial of serviceCeh v8 labs module 10 denial of service
Ceh v8 labs module 10 denial of serviceAsep Sopyan
 
Introduction to trojans and backdoors
Introduction to trojans and backdoorsIntroduction to trojans and backdoors
Introduction to trojans and backdoorsjibinmanjooran
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentTeymur Kheirkhabarov
 

What's hot (20)

SANS Digital Forensics and Incident Response Poster 2012
SANS Digital Forensics and Incident Response Poster 2012SANS Digital Forensics and Incident Response Poster 2012
SANS Digital Forensics and Incident Response Poster 2012
 
Return Address – The Silver Bullet
Return Address – The Silver BulletReturn Address – The Silver Bullet
Return Address – The Silver Bullet
 
Automating malware analysis
Automating malware analysis Automating malware analysis
Automating malware analysis
 
Malware Classification Using Structured Control Flow
Malware Classification Using Structured Control FlowMalware Classification Using Structured Control Flow
Malware Classification Using Structured Control Flow
 
Android malware presentation
Android malware presentationAndroid malware presentation
Android malware presentation
 
The Future of Automated Malware Generation
The Future of Automated Malware GenerationThe Future of Automated Malware Generation
The Future of Automated Malware Generation
 
Reverse engineering malware
Reverse engineering malwareReverse engineering malware
Reverse engineering malware
 
Ceh v8 labs module 03 scanning networks
Ceh v8 labs module 03 scanning networksCeh v8 labs module 03 scanning networks
Ceh v8 labs module 03 scanning networks
 
CarolinaCon 2008 Rootkits Then and Now
CarolinaCon 2008 Rootkits Then and NowCarolinaCon 2008 Rootkits Then and Now
CarolinaCon 2008 Rootkits Then and Now
 
Reconnaissance & Scanning
Reconnaissance & ScanningReconnaissance & Scanning
Reconnaissance & Scanning
 
Watchtowers of the Internet - Source Boston 2012
Watchtowers of the Internet - Source Boston 2012Watchtowers of the Internet - Source Boston 2012
Watchtowers of the Internet - Source Boston 2012
 
Digital Immunity -The Myths and Reality
Digital Immunity -The Myths and RealityDigital Immunity -The Myths and Reality
Digital Immunity -The Myths and Reality
 
Reverse Engineering Malware
Reverse Engineering MalwareReverse Engineering Malware
Reverse Engineering Malware
 
Ceh v8 labs module 07 viruses and worms
Ceh v8 labs module 07 viruses and wormsCeh v8 labs module 07 viruses and worms
Ceh v8 labs module 07 viruses and worms
 
Analysis Of Adverarial Code - The Role of Malware Kits
Analysis Of Adverarial Code - The Role of Malware KitsAnalysis Of Adverarial Code - The Role of Malware Kits
Analysis Of Adverarial Code - The Role of Malware Kits
 
Ceh v8 labs module 05 system hacking
Ceh v8 labs module 05 system hackingCeh v8 labs module 05 system hacking
Ceh v8 labs module 05 system hacking
 
Ceh v8 labs module 10 denial of service
Ceh v8 labs module 10 denial of serviceCeh v8 labs module 10 denial of service
Ceh v8 labs module 10 denial of service
 
Catching fileless attacks
Catching fileless attacksCatching fileless attacks
Catching fileless attacks
 
Introduction to trojans and backdoors
Introduction to trojans and backdoorsIntroduction to trojans and backdoors
Introduction to trojans and backdoors
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows Environment
 

Similar to Intro2 malwareanalysisshort

Ceh certified ethical hacker
Ceh certified ethical hackerCeh certified ethical hacker
Ceh certified ethical hackerbestip
 
Malware and Anti-Malware Seminar by Benny Czarny
Malware and Anti-Malware Seminar by Benny CzarnyMalware and Anti-Malware Seminar by Benny Czarny
Malware and Anti-Malware Seminar by Benny CzarnyOPSWAT
 
Modern malware and threats
Modern malware and threatsModern malware and threats
Modern malware and threatsMartin Holovský
 
Metasploit Framework Executable Encoding
Metasploit Framework Executable EncodingMetasploit Framework Executable Encoding
Metasploit Framework Executable Encodingtechnology_flow
 
Introduction To Ethical Hacking
Introduction To Ethical HackingIntroduction To Ethical Hacking
Introduction To Ethical HackingRaghav Bisht
 
Advanced malware analysis training session 7 malware memory forensics
Advanced malware analysis training session 7 malware memory forensicsAdvanced malware analysis training session 7 malware memory forensics
Advanced malware analysis training session 7 malware memory forensicsCysinfo Cyber Security Community
 
The Hacking Games - Operation System Vulnerabilities Meetup 29112022
The Hacking Games - Operation System Vulnerabilities Meetup 29112022The Hacking Games - Operation System Vulnerabilities Meetup 29112022
The Hacking Games - Operation System Vulnerabilities Meetup 29112022lior mazor
 
Basic Dynamic Analysis of Malware
Basic Dynamic Analysis of MalwareBasic Dynamic Analysis of Malware
Basic Dynamic Analysis of MalwareNatraj G
 
Cyber warfare introduction
Cyber warfare introductionCyber warfare introduction
Cyber warfare introductionjagadeesh katla
 
Stuxnet redux. malware attribution & lessons learned
Stuxnet redux. malware attribution & lessons learnedStuxnet redux. malware attribution & lessons learned
Stuxnet redux. malware attribution & lessons learnedYury Chemerkin
 
Introduction To Information Security
Introduction To Information SecurityIntroduction To Information Security
Introduction To Information Securitybelsis
 
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
Reversing & Malware Analysis Training Part 9 - Advanced Malware AnalysisReversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysissecurityxploded
 
Viruses and Anti-Viruses
Viruses and Anti-VirusesViruses and Anti-Viruses
Viruses and Anti-VirusesAyman Hussein
 
Finalppt metasploit
Finalppt metasploitFinalppt metasploit
Finalppt metasploitdevilback
 
Reversing malware analysis trainingpart9 advanced malware analysis
Reversing malware analysis trainingpart9 advanced malware analysisReversing malware analysis trainingpart9 advanced malware analysis
Reversing malware analysis trainingpart9 advanced malware analysisCysinfo Cyber Security Community
 
Scaling Web 2.0 Malware Infection
Scaling Web 2.0 Malware InfectionScaling Web 2.0 Malware Infection
Scaling Web 2.0 Malware InfectionWayne Huang
 
TRISC 2010 - Grapevine , Texas
TRISC 2010 - Grapevine , TexasTRISC 2010 - Grapevine , Texas
TRISC 2010 - Grapevine , TexasAditya K Sood
 

Similar to Intro2 malwareanalysisshort (20)

Ceh certified ethical hacker
Ceh certified ethical hackerCeh certified ethical hacker
Ceh certified ethical hacker
 
Malware and Anti-Malware Seminar by Benny Czarny
Malware and Anti-Malware Seminar by Benny CzarnyMalware and Anti-Malware Seminar by Benny Czarny
Malware and Anti-Malware Seminar by Benny Czarny
 
Modern malware and threats
Modern malware and threatsModern malware and threats
Modern malware and threats
 
Metasploit Framework Executable Encoding
Metasploit Framework Executable EncodingMetasploit Framework Executable Encoding
Metasploit Framework Executable Encoding
 
Basic malware analysis
Basic malware analysisBasic malware analysis
Basic malware analysis
 
Introduction To Ethical Hacking
Introduction To Ethical HackingIntroduction To Ethical Hacking
Introduction To Ethical Hacking
 
Advanced malware analysis training session 7 malware memory forensics
Advanced malware analysis training session 7 malware memory forensicsAdvanced malware analysis training session 7 malware memory forensics
Advanced malware analysis training session 7 malware memory forensics
 
The Hacking Games - Operation System Vulnerabilities Meetup 29112022
The Hacking Games - Operation System Vulnerabilities Meetup 29112022The Hacking Games - Operation System Vulnerabilities Meetup 29112022
The Hacking Games - Operation System Vulnerabilities Meetup 29112022
 
Basic Dynamic Analysis of Malware
Basic Dynamic Analysis of MalwareBasic Dynamic Analysis of Malware
Basic Dynamic Analysis of Malware
 
Cyber warfare introduction
Cyber warfare introductionCyber warfare introduction
Cyber warfare introduction
 
Stuxnet redux. malware attribution & lessons learned
Stuxnet redux. malware attribution & lessons learnedStuxnet redux. malware attribution & lessons learned
Stuxnet redux. malware attribution & lessons learned
 
Introduction To Information Security
Introduction To Information SecurityIntroduction To Information Security
Introduction To Information Security
 
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
Reversing & Malware Analysis Training Part 9 - Advanced Malware AnalysisReversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
 
Malware
MalwareMalware
Malware
 
Viruses and Anti-Viruses
Viruses and Anti-VirusesViruses and Anti-Viruses
Viruses and Anti-Viruses
 
NetWitness
NetWitnessNetWitness
NetWitness
 
Finalppt metasploit
Finalppt metasploitFinalppt metasploit
Finalppt metasploit
 
Reversing malware analysis trainingpart9 advanced malware analysis
Reversing malware analysis trainingpart9 advanced malware analysisReversing malware analysis trainingpart9 advanced malware analysis
Reversing malware analysis trainingpart9 advanced malware analysis
 
Scaling Web 2.0 Malware Infection
Scaling Web 2.0 Malware InfectionScaling Web 2.0 Malware Infection
Scaling Web 2.0 Malware Infection
 
TRISC 2010 - Grapevine , Texas
TRISC 2010 - Grapevine , TexasTRISC 2010 - Grapevine , Texas
TRISC 2010 - Grapevine , Texas
 

More from Vincent Ohprecio

ipython notebook poc memory forensics
ipython notebook poc memory forensicsipython notebook poc memory forensics
ipython notebook poc memory forensicsVincent Ohprecio
 
Learning iPython Notebook Volatility Memory Forensics
Learning iPython Notebook Volatility Memory ForensicsLearning iPython Notebook Volatility Memory Forensics
Learning iPython Notebook Volatility Memory ForensicsVincent Ohprecio
 
iPython Notebook Volatility Memory Forensics SilentBanker
iPython Notebook Volatility Memory Forensics SilentBankeriPython Notebook Volatility Memory Forensics SilentBanker
iPython Notebook Volatility Memory Forensics SilentBankerVincent Ohprecio
 
iPython Notebook Volatility For Memory Forensics
iPython Notebook Volatility For Memory ForensicsiPython Notebook Volatility For Memory Forensics
iPython Notebook Volatility For Memory ForensicsVincent Ohprecio
 
iPhone Forensics Without iPhone using iTunes Backup
iPhone Forensics Without iPhone using iTunes BackupiPhone Forensics Without iPhone using iTunes Backup
iPhone Forensics Without iPhone using iTunes BackupVincent Ohprecio
 
Forensic Challenge 10 - FC5 Attack Dataset Visualization
Forensic Challenge 10 - FC5 Attack Dataset VisualizationForensic Challenge 10 - FC5 Attack Dataset Visualization
Forensic Challenge 10 - FC5 Attack Dataset VisualizationVincent Ohprecio
 
Hacking school computers for fun profit and better grades short
Hacking school computers for fun profit and better grades shortHacking school computers for fun profit and better grades short
Hacking school computers for fun profit and better grades shortVincent Ohprecio
 

More from Vincent Ohprecio (8)

ipython notebook poc memory forensics
ipython notebook poc memory forensicsipython notebook poc memory forensics
ipython notebook poc memory forensics
 
Learning iPython Notebook Volatility Memory Forensics
Learning iPython Notebook Volatility Memory ForensicsLearning iPython Notebook Volatility Memory Forensics
Learning iPython Notebook Volatility Memory Forensics
 
iPython Notebook Volatility Memory Forensics SilentBanker
iPython Notebook Volatility Memory Forensics SilentBankeriPython Notebook Volatility Memory Forensics SilentBanker
iPython Notebook Volatility Memory Forensics SilentBanker
 
iPython Notebook Volatility For Memory Forensics
iPython Notebook Volatility For Memory ForensicsiPython Notebook Volatility For Memory Forensics
iPython Notebook Volatility For Memory Forensics
 
iPhone Forensics Without iPhone using iTunes Backup
iPhone Forensics Without iPhone using iTunes BackupiPhone Forensics Without iPhone using iTunes Backup
iPhone Forensics Without iPhone using iTunes Backup
 
Forensic Challenge 10 - FC5 Attack Dataset Visualization
Forensic Challenge 10 - FC5 Attack Dataset VisualizationForensic Challenge 10 - FC5 Attack Dataset Visualization
Forensic Challenge 10 - FC5 Attack Dataset Visualization
 
Big databigideasit4bc
Big databigideasit4bcBig databigideasit4bc
Big databigideasit4bc
 
Hacking school computers for fun profit and better grades short
Hacking school computers for fun profit and better grades shortHacking school computers for fun profit and better grades short
Hacking school computers for fun profit and better grades short
 

Recently uploaded

Benefits Of Flutter Compared To Other Frameworks
Benefits Of Flutter Compared To Other FrameworksBenefits Of Flutter Compared To Other Frameworks
Benefits Of Flutter Compared To Other FrameworksSoftradix Technologies
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j
 
Pigging Solutions in Pet Food Manufacturing
Pigging Solutions in Pet Food ManufacturingPigging Solutions in Pet Food Manufacturing
Pigging Solutions in Pet Food ManufacturingPigging Solutions
 
Hyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your Budget
Hyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your BudgetHyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your Budget
Hyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your BudgetEnjoy Anytime
 
Snow Chain-Integrated Tire for a Safe Drive on Winter Roads
Snow Chain-Integrated Tire for a Safe Drive on Winter RoadsSnow Chain-Integrated Tire for a Safe Drive on Winter Roads
Snow Chain-Integrated Tire for a Safe Drive on Winter RoadsHyundai Motor Group
 
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...Alan Dix
 
Human Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsHuman Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsMark Billinghurst
 
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 3652toLead Limited
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesSinan KOZAK
 
Key Features Of Token Development (1).pptx
Key Features Of Token Development (1).pptxKey Features Of Token Development (1).pptx
Key Features Of Token Development (1).pptxLBM Solutions
 
Next-generation AAM aircraft unveiled by Supernal, S-A2
Next-generation AAM aircraft unveiled by Supernal, S-A2Next-generation AAM aircraft unveiled by Supernal, S-A2
Next-generation AAM aircraft unveiled by Supernal, S-A2Hyundai Motor Group
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking MenDelhi Call girls
 
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024Scott Keck-Warren
 
IAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI SolutionsIAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI SolutionsEnterprise Knowledge
 
CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):comworks
 
Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Allon Mureinik
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationRidwan Fadjar
 
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...Patryk Bandurski
 
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersEnhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersThousandEyes
 

Recently uploaded (20)

E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxE-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
 
Benefits Of Flutter Compared To Other Frameworks
Benefits Of Flutter Compared To Other FrameworksBenefits Of Flutter Compared To Other Frameworks
Benefits Of Flutter Compared To Other Frameworks
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
 
Pigging Solutions in Pet Food Manufacturing
Pigging Solutions in Pet Food ManufacturingPigging Solutions in Pet Food Manufacturing
Pigging Solutions in Pet Food Manufacturing
 
Hyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your Budget
Hyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your BudgetHyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your Budget
Hyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your Budget
 
Snow Chain-Integrated Tire for a Safe Drive on Winter Roads
Snow Chain-Integrated Tire for a Safe Drive on Winter RoadsSnow Chain-Integrated Tire for a Safe Drive on Winter Roads
Snow Chain-Integrated Tire for a Safe Drive on Winter Roads
 
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
 
Human Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsHuman Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR Systems
 
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen Frames
 
Key Features Of Token Development (1).pptx
Key Features Of Token Development (1).pptxKey Features Of Token Development (1).pptx
Key Features Of Token Development (1).pptx
 
Next-generation AAM aircraft unveiled by Supernal, S-A2
Next-generation AAM aircraft unveiled by Supernal, S-A2Next-generation AAM aircraft unveiled by Supernal, S-A2
Next-generation AAM aircraft unveiled by Supernal, S-A2
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
 
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024
 
IAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI SolutionsIAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI Solutions
 
CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):
 
Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 Presentation
 
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
 
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersEnhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
 

Intro2 malwareanalysisshort