12:32 a.m.
I've got a memory forensics presentation coming up next week and I'd like to use a
sample that will illustrate a crossview example.
Specifically, I'd like to use an example that hides from pslist on the running system
(don't want a DKOM example) but we can find it using Volatility.
I'd like it to be something running and not a process injection sample.
Does someone have a suggestion which one may provide a good illustration?
Thanks,
Mike
1:47 a.m.
have fun.
http://www.malwaredomainlist.com/mdl.php
--
[]s Fosforo
-------------------------------------------------------------
"Only the wisest and stupidest of men never change."
-Confusio
-------------------------------------------------------------
On Thu, May 3, 2012 at 1:32 AM, Mike Lambert <dragonforen(a)hotmail.com> wrote:
I've got a memory forensics presentation coming up
next week and I'd like to
use a sample that will illustrate a crossview example.
Specifically, I'd like to use an example that hides from pslist on the
running system (don't want a DKOM example) but we can find it using
Volatility.
I'd like it to be something running and not a process injection sample.
Does someone have a suggestion which one may provide a good illustration?
Thanks,
Mike
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
10:41 a.m.
Hi Fosforo, I'm afraid I was not clear, but thanks for the URL.
I'm looking for a suggestion of a sample NAME that had those characteristics I was
looking for.
I use malwaredomainlist too; and if I did not have a sample, I'd probably look for one
there.
I will be using a VM in the demo so it would have to run in a demo and illustrate the
crossview technique.
Mike
From: fosforo(a)gmail.com
Date: Thu, 3 May 2012 02:47:02 -0300
Subject: Re: [Vol-users] Need to pick a malware for a demo
To: dragonforen(a)hotmail.com
CC: vol-users(a)volatilityfoundation.org
have fun.
http://www.malwaredomainlist.com/mdl.php
--
[]s Fosforo
-------------------------------------------------------------
"Only the wisest and stupidest of men never change."
-Confusio
-------------------------------------------------------------
On Thu, May 3, 2012 at 1:32 AM, Mike Lambert <dragonforen(a)hotmail.com> wrote:
> I've got a memory forensics presentation coming up next week and I'd like
to
> use a sample that will illustrate a crossview example.
>
> Specifically, I'd like to use an example that hides from pslist on the
> running system (don't want a DKOM example) but we can find it using
> Volatility.
> I'd like it to be something running and not a process injection sample.
>
> Does someone have a suggestion which one may provide a good illustration?
>
> Thanks,
> Mike
>
>
> _______________________________________________
> Vol-users mailing list
> Vol-users(a)volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
>
10:57 a.m.
Check out the Hacker Defender rootkit. I am pretty sure I demoed
exactly what you are wanting to do (including using Volatility to
reveal the rootkit) about a year ago and this malware was a good
example and easy to use. I don't know for sure that it hides from
PsList but it hides from the built-in windows tools.
Email me if you can't find a copy.
On Wed, May 2, 2012 at 11:32 PM, Mike Lambert <dragonforen(a)hotmail.com> wrote:
I've got a memory forensics presentation coming up
next week and I'd like to
use a sample that will illustrate a crossview example.
Specifically, I'd like to use an example that hides from pslist on the
running system (don't want a DKOM example) but we can find it using
Volatility.
I'd like it to be something running and not a process injection sample.
Does someone have a suggestion which one may provide a good illustration?
Thanks,
Mike
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
6:09 p.m.
Hi Rob,
Thanks for the suggestion. As I recall that would fit the profile when combined with
another tool. And I think it will run in a VM.
In the past a friend of mine used Hacker Defender and Optiplex as an example in a
presentation. I'd like to pick something else if possible (would rather not duplicate
and look lame).
What would be really cool is something current that runs in a VM and is a good pslist
crossview demo. If I can't find something current, I'll fall back to HD. Good
thought!
Thanks much for the suggestion. If you have any other thoughts I appreciate them.
Mike
Date: Thu, 3 May 2012 09:57:16 -0500
Subject: Re: [Vol-users] Need to pick a malware for a demo
From: robdewhirst(a)gmail.com
To: vol-users(a)volatilityfoundation.org
Check out the Hacker Defender rootkit. I am pretty sure I demoed
exactly what you are wanting to do (including using Volatility to
reveal the rootkit) about a year ago and this malware was a good
example and easy to use. I don't know for sure that it hides from
PsList but it hides from the built-in windows tools.
Email me if you can't find a copy.
On Wed, May 2, 2012 at 11:32 PM, Mike Lambert <dragonforen(a)hotmail.com> wrote:
I've got a memory forensics presentation
coming up next week and I'd like to
use a sample that will illustrate a crossview example.
Specifically, I'd like to use an example that hides from pslist on the
running system (don't want a DKOM example) but we can find it using
Volatility.
I'd like it to be something running and not a process injection sample.
Does someone have a suggestion which one may provide a good illustration?
Thanks,
Mike
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
9:39 p.m.
I just seem to recall hacker defender being touchy about where it's
config file was located and the name of it. Claimed to support options
that didn't work. HTH.
I'd like to know what you end up using because I am preparing a
workshop in a month or so and need a couple more ideas.
On Thu, May 3, 2012 at 5:09 PM, Mike Lambert <dragonforen(a)hotmail.com> wrote:
Hi Rob,
Thanks for the suggestion. As I recall that would fit the profile when
combined with another tool. And I think it will run in a VM.
In the past a friend of mine used Hacker Defender and Optiplex as an example
in a presentation. I'd like to pick something else if possible (would
rather not duplicate and look lame).
What would be really cool is something current that runs in a VM and is a
good pslist crossview demo. If I can't find something current, I'll fall
back to HD. Good thought!
Thanks much for the suggestion. If you have any other thoughts I appreciate
them.
Mike
Date: Thu, 3 May 2012 09:57:16 -0500
Subject: Re: [Vol-users] Need to pick a malware
for a demo
From: robdewhirst(a)gmail.com
To: vol-users(a)volatilityfoundation.org
>
> Check out the Hacker Defender rootkit. I am pretty sure I demoed
> exactly what you are wanting to do (including using Volatility to
> reveal the rootkit) about a year ago and this malware was a good
> example and easy to use. I don't know for sure that it hides from
> PsList but it hides from the built-in windows tools.
>
> Email me if you can't find a copy.
>
> On Wed, May 2, 2012 at 11:32 PM, Mike Lambert <dragonforen(a)hotmail.com>
> wrote:
> > I've got a memory forensics presentation coming up next week and I'd
> > like to
> > use a sample that will illustrate a crossview example.
> >
> > Specifically, I'd like to use an example that hides from pslist on the
> > running system (don't want a DKOM example) but we can find it using
> > Volatility.
> > I'd like it to be something running and not a process injection sample.
> >
> > Does someone have a suggestion which one may provide a good
> > illustration?
> >
> > Thanks,
> > Mike
> >
> >
> > _______________________________________________
> > Vol-users mailing list
> > Vol-users(a)volatilityfoundation.org
> > http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
> >
> _______________________________________________
> Vol-users mailing list
> Vol-users(a)volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
11:05 p.m.
try TDL
--
[]s Fosforo
-------------------------------------------------------------
"Only the wisest and stupidest of men never change."
-Confusio
-------------------------------------------------------------
On Thu, May 3, 2012 at 10:39 PM, Dewhirst, Rob <robdewhirst(a)gmail.com> wrote:
I just seem to recall hacker defender being touchy
about where it's
config file was located and the name of it. Claimed to support options
that didn't work. HTH.
I'd like to know what you end up using because I am preparing a
workshop in a month or so and need a couple more ideas.
On Thu, May 3, 2012 at 5:09 PM, Mike Lambert <dragonforen(a)hotmail.com> wrote:
Hi Rob,
Thanks for the suggestion. As I recall that would fit the profile when
combined with another tool. And I think it will run in a VM.
In the past a friend of mine used Hacker Defender and Optiplex as an example
in a presentation. I'd like to pick something else if possible (would
rather not duplicate and look lame).
What would be really cool is something current that runs in a VM and is a
good pslist crossview demo. If I can't find something current, I'll fall
back to HD. Good thought!
Thanks much for the suggestion. If you have any other thoughts I appreciate
them.
Mike
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users Date: Thu, 3 May 2012 09:57:16 -0500
Subject: Re: [Vol-users] Need to pick a malware
for a demo
From: robdewhirst(a)gmail.com
To: vol-users(a)volatilityfoundation.org
>
> Check out the Hacker Defender rootkit. I am pretty sure I demoed
> exactly what you are wanting to do (including using Volatility to
> reveal the rootkit) about a year ago and this malware was a good
> example and easy to use. I don't know for sure that it hides from
> PsList but it hides from the built-in windows tools.
>
> Email me if you can't find a copy.
>
> On Wed, May 2, 2012 at 11:32 PM, Mike Lambert <dragonforen(a)hotmail.com>
> wrote:
> > I've got a memory forensics presentation coming up next week and I'd
> > like to
> > use a sample that will illustrate a crossview example.
> >
> > Specifically, I'd like to use an example that hides from pslist on the
> > running system (don't want a DKOM example) but we can find it using
> > Volatility.
> > I'd like it to be something running and not a process injection sample.
> >
> > Does someone have a suggestion which one may provide a good
> > illustration?
> >
> > Thanks,
> > Mike
> >
> >
> > _______________________________________________
> > Vol-users mailing list
> > Vol-users(a)volatilityfoundation.org
> > http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
> >
> _______________________________________________
> Vol-users mailing list
> Vol-users(a)volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
1:29 p.m.
Hi Rob,
I spent the day yesterday testing several new samples I'd gotten from the internet
last week. They were either VM aware or not functioning properly. Blew the whole day.
I ended up looking at previous tests I'd done. I tried a Spyeye I picked up in
January. It was named us1.exe. It is the Spyeye that names itself
c:\usxxxxxxxx\usxxxxxxxx.exe It illustrates the crossview I wanted, can't see it in a
Volatile data collection, but can with Volatilty's pslist. And, it infects a VM
nicely.
Do you have a copy?
Mike
Date: Thu, 3 May 2012 20:39:13 -0500
Subject: Re: [Vol-users] Need to pick a malware for a demo
From: robdewhirst(a)gmail.com
To: vol-users(a)volatilityfoundation.org
I just seem to recall hacker defender being touchy about where it's
config file was located and the name of it. Claimed to support options
that didn't work. HTH.
I'd like to know what you end up using because I am preparing a
workshop in a month or so and need a couple more ideas.
On Thu, May 3, 2012 at 5:09 PM, Mike Lambert <dragonforen(a)hotmail.com> wrote:
Hi Rob,
Thanks for the suggestion. As I recall that would fit the profile when
combined with another tool. And I think it will run in a VM.
In the past a friend of mine used Hacker Defender and Optiplex as an example
in a presentation. I'd like to pick something else if possible (would
rather not duplicate and look lame).
What would be really cool is something current that runs in a VM and is a
good pslist crossview demo. If I can't find something current, I'll fall
back to HD. Good thought!
Thanks much for the suggestion. If you have any other thoughts I appreciate
them.
Mike
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users Date: Thu, 3 May 2012 09:57:16 -0500
Subject: Re: [Vol-users] Need to pick a malware
for a demo
From: robdewhirst(a)gmail.com
To: vol-users(a)volatilityfoundation.org
>
> Check out the Hacker Defender rootkit. I am pretty sure I demoed
> exactly what you are wanting to do (including using Volatility to
> reveal the rootkit) about a year ago and this malware was a good
> example and easy to use. I don't know for sure that it hides from
> PsList but it hides from the built-in windows tools.
>
> Email me if you can't find a copy.
>
> On Wed, May 2, 2012 at 11:32 PM, Mike Lambert <dragonforen(a)hotmail.com>
> wrote:
> > I've got a memory forensics presentation coming up next week and I'd
> > like to
> > use a sample that will illustrate a crossview example.
> >
> > Specifically, I'd like to use an example that hides from pslist on the
> > running system (don't want a DKOM example) but we can find it using
> > Volatility.
> > I'd like it to be something running and not a process injection sample.
> >
> > Does someone have a suggestion which one may provide a good
> > illustration?
> >
> > Thanks,
> > Mike
> >
> >
> > _______________________________________________
> > Vol-users mailing list
> > Vol-users(a)volatilityfoundation.org
> > http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
> >
> _______________________________________________
> Vol-users mailing list
> Vol-users(a)volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
2:03 p.m.
I do not have a copy but I have not looked.
On Fri, May 4, 2012 at 12:29 PM, Mike Lambert <dragonforen(a)hotmail.com> wrote:
Hi Rob,
I spent the day yesterday testing several new samples I'd gotten from the
internet last week. They were either VM aware or not functioning properly.
Blew the whole day.
I ended up looking at previous tests I'd done. I tried a Spyeye I picked up
in January. It was named us1.exe. It is the Spyeye that names itself
c:\usxxxxxxxx\usxxxxxxxx.exe It illustrates the crossview I wanted, can't
see it in a Volatile data collection, but can with Volatilty's pslist. And,
it infects a VM nicely.
Do you have a copy?
Mike
Date: Thu, 3 May 2012 20:39:13 -0500
> Subject: Re: [Vol-users] Need to pick a malware for a demo
> From: robdewhirst(a)gmail.com
> To: vol-users(a)volatilityfoundation.org
>
> I just seem to recall hacker defender being touchy about where it's
> config file was located and the name of it. Claimed to support options
> that didn't work. HTH.
>
> I'd like to know what you end up using because I am preparing a
> workshop in a month or so and need a couple more ideas.
>
> On Thu, May 3, 2012 at 5:09 PM, Mike Lambert <dragonforen(a)hotmail.com>
> wrote:
> > Hi Rob,
> >
> > Thanks for the suggestion. As I recall that would fit the profile when
> > combined with another tool. And I think it will run in a VM.
> >
> > In the past a friend of mine used Hacker Defender and Optiplex as an
> > example
> > in a presentation. I'd like to pick something else if possible (would
> > rather not duplicate and look lame).
> >
> > What would be really cool is something current that runs in a VM and is
> > a
> > good pslist crossview demo. If I can't find something current, I'll
> > fall
> > back to HD. Good thought!
> >
> > Thanks much for the suggestion. If you have any other thoughts I
> > appreciate
> > them.
> >
> > Mike
> >
> >> Date: Thu, 3 May 2012 09:57:16 -0500
> >
> >> Subject: Re: [Vol-users] Need to pick a malware for a demo
> >> From: robdewhirst(a)gmail.com
> >> To: vol-users(a)volatilityfoundation.org
> >
> >>
> >> Check out the Hacker Defender rootkit. I am pretty sure I demoed
> >> exactly what you are wanting to do (including using Volatility to
> >> reveal the rootkit) about a year ago and this malware was a good
> >> example and easy to use. I don't know for sure that it hides from
> >> PsList but it hides from the built-in windows tools.
> >>
> >> Email me if you can't find a copy.
> >>
> >> On Wed, May 2, 2012 at 11:32 PM, Mike Lambert
<dragonforen(a)hotmail.com>
> >> wrote:
> >> > I've got a memory forensics presentation coming up next week and
I'd
> >> > like to
> >> > use a sample that will illustrate a crossview example.
> >> >
> >> > Specifically, I'd like to use an example that hides from pslist on
> >> > the
> >> > running system (don't want a DKOM example) but we can find it
using
> >> > Volatility.
> >> > I'd like it to be something running and not a process injection
> >> > sample.
> >> >
> >> > Does someone have a suggestion which one may provide a good
> >> > illustration?
> >> >
> >> > Thanks,
> >> > Mike
> >> >
> >> >
> >> > _______________________________________________
> >> > Vol-users mailing list
> >> > Vol-users(a)volatilityfoundation.org
> >> > http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
> >> >
> >> _______________________________________________
> >> Vol-users mailing list
> >> Vol-users(a)volatilityfoundation.org
> >> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
> _______________________________________________
> Vol-users mailing list
> Vol-users(a)volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
4639
days inactive
4640
days old
vol-users@lists.volatilityfoundation.org
8 comments
3 participants
participants (3)
-
Dewhirst, Rob -
Fosforo -
Mike Lambert