Upload File

Download - Dissecting the Hack: Malware Analysis 101

Transcript
Page 1: Dissecting the Hack: Malware Analysis 101

Dissecting the HackMalware Analysis 101

Sunday, September 19, 2010

Page 2: Dissecting the Hack: Malware Analysis 101

Who am I?

Gerry Brunelle

System Security Engineer for Boeing

Sunday, September 19, 2010

Page 3: Dissecting the Hack: Malware Analysis 101

What were covering

Malware 101

Analysis 101

evil.exe

Sunday, September 19, 2010

Page 4: Dissecting the Hack: Malware Analysis 101

Malware 101

So..what is malware?

A piece of software that accesses a computer secretly without the owners consent

Some types are viruses, rootkits, and trojans

Are designed to do almost anything

Sunday, September 19, 2010

Page 5: Dissecting the Hack: Malware Analysis 101

Malware 101

How does malware affect you?

Steals information from your systems

Compromises integrity of you data

Cripples networks

Sunday, September 19, 2010

Page 6: Dissecting the Hack: Malware Analysis 101

Analysis 101

2 Types

Behavioral analysis

Code analysis

Sunday, September 19, 2010

Page 7: Dissecting the Hack: Malware Analysis 101

Analysis 101

Behavioral analysis

What the malware does

File creation/modification

Network activity

Registry activity

Sunday, September 19, 2010

Page 8: Dissecting the Hack: Malware Analysis 101

Analysis 101

Code analysis

What you can’t observe

Code characteristics

Packing/unpacking

Embedded information

Sunday, September 19, 2010

Page 9: Dissecting the Hack: Malware Analysis 101

Our scenario

User calls stating their machine is slow

Escalated to L2 support for on-site

On-site tech observes odd behavior

evil.exe running

Connected to port 1337 somewhere

Tech refers case to Security Operations Center

Sunday, September 19, 2010

Page 10: Dissecting the Hack: Malware Analysis 101

Our Scenario

SOC CIRT Team mobilized

They are now observing multiple infections

Estimated infections at ~1000

Traffic is now crippling traffic at the border

Have received evil.exe for analysis

Sunday, September 19, 2010

Page 11: Dissecting the Hack: Malware Analysis 101

Our scenario

Time to do some hacking...

Sunday, September 19, 2010


Top Related

Dissecting Nemo
Dissecting Nemo
clarity · or malware incident, the direct costs of forensics and investigation. Because of the additional cost of forensics and investigations associated with hack and malware incidents,
clarity · or malware incident, the direct costs of forensics and investigation. Because of the additional cost of forensics and investigations associated with hack and malware incidents,
Dissecting A Ransomware-infected MBR - Hack In Paris · 2 About Me Senior Security Researcher @ Fortinet 22 published articles in Virus Bulletin Regular contributor in our company
Dissecting A Ransomware-infected MBR - Hack In Paris · 2 About Me Senior Security Researcher @ Fortinet 22 published articles in Virus Bulletin Regular contributor in our company
Hack the hack vivatech
Hack the hack vivatech
System Virginity Verifier Defining the Roadmap for Malware Detection on Windows System Joanna Rutkowska Hack In The Box Security
System Virginity Verifier Defining the Roadmap for Malware Detection on Windows System Joanna Rutkowska Hack In The Box Security
Malware y Hack
Malware y Hack
Dissecting Android Malware: Characterization and · PDF fileDissecting Android Malware: Characterization and Evolution ... Android malware, ranging ... if we take a look at the Android
Dissecting Android Malware: Characterization and · PDF fileDissecting Android Malware: Characterization and Evolution ... Android malware, ranging ... if we take a look at the Android
The power of the team work Management of Dissecting ... · High Rotated Payloads: 1. Exchange Malware Affiliates binaries 2. Very low AV detection rates ... We PWNED their CNC ;-)
The power of the team work Management of Dissecting ... · High Rotated Payloads: 1. Exchange Malware Affiliates binaries 2. Very low AV detection rates ... We PWNED their CNC ;-)