Erinevus lehekülje "Malware:ITX8042:2014:LAB3" redaktsioonide vahel

Allikas: Kursused
Mine navigeerimisribale Mine otsikasti
(Uus lehekülg: '== LAB3 == ===Additional Reading + presentations!=== [https://docs.google.com/presentation/d/1uelV4BKcJXknrMamF2tQFLl1oaSjcYGpmWs8q1kkgv8/edit?usp=sharing Slides for lab] === ...')
 
 
9. rida: 9. rida:
 
=== Things to consider in exercise ===
 
=== Things to consider in exercise ===
  
*File Has sha 256 and md5
+
*Find sha256 and md5
*Search it in Virus Total
+
*Search for it in the Virus Total
*strings analysis
+
*Strings analysis
 
*Use  two  out of three for quick and dirty  
 
*Use  two  out of three for quick and dirty  
  
      https://www.virustotal.com/
+
  https://www.virustotal.com/
      https://www.metascan-online.com/
+
  https://www.metascan-online.com/
      https://malwr.com/
+
  https://malwr.com/
  
 
*Find at least 2 additional places for quick and dirty analysis
 
*Find at least 2 additional places for quick and dirty analysis
*Compare results
+
*Compare results  
 +
 
  
 
   
 
   
 
=== Things to present in report  ===
 
=== Things to present in report  ===
  
* Where and how you found additional file
+
*Describe where and how you found additional files/malware
* Hashes for each file  
+
*Provide hashes for each file  
* Most common name (each name differently but what was most common known name) for each file
+
*Provide most common name for each file (Most of the files have multiple names)
* Strings that sound meanigful for you and why  
+
*List strings (from the strings command) that sound meaningful to you with reasons as to why
* Links to quick and dirty analysis  
+
*Provide links to the quick and dirty analysis  
* Interesting features that you have learned.
+
*Document interesting features that you learned
* Quick solution how to fix without having anti-virus.
+
*Quick solution on how to fix without having anti-virus or reinstalling the system.

Viimane redaktsioon: 24. september 2014, kell 20:56

LAB3

Additional Reading + presentations!

Slides for lab

Exercise specifics are in slides

Things to consider in exercise

  • Find sha256 and md5
  • Search for it in the Virus Total
  • Strings analysis
  • Use two out of three for quick and dirty
  https://www.virustotal.com/
  https://www.metascan-online.com/
  https://malwr.com/
  • Find at least 2 additional places for quick and dirty analysis
  • Compare results


Things to present in report

  • Describe where and how you found additional files/malware
  • Provide hashes for each file
  • Provide most common name for each file (Most of the files have multiple names)
  • List strings (from the strings command) that sound meaningful to you with reasons as to why
  • Provide links to the quick and dirty analysis
  • Document interesting features that you learned
  • Quick solution on how to fix without having anti-virus or reinstalling the system.