Malware:ITX8060:2012 - Redigeerimiste ajalugu

Lepik – 17. detsember 2012, kell 19:10

2012-12-17T19:10:39Z

←Vanem redaktsioon		Redaktsioon: 17. detsember 2012, kell 21:10
4. rida:		4. rida:

	== Announcements ==		== Announcements ==
	[https://docs.google.com/spreadsheet/viewform?fromEmail=true&formkey=~~dHdUalZhZ3JyX2lVV0llVmV~~ MW2 Openbook quiz]		[https://docs.google.com/spreadsheet/viewform?fromEmail=true&formkey=dHdUalZhZ3JyX2lVV0llVmVvZDMzZkE6MQ MW2 Openbook quiz]

Lepik – 17. detsember 2012, kell 16:30

2012-12-17T16:30:17Z

←Vanem redaktsioon		Redaktsioon: 17. detsember 2012, kell 18:30
19. rida:		19. rida:
	Where , what , when and so on.		Where , what , when and so on.

	27.12.2012		==== Deadline 27.12.2012 ====

Lepik – 17. detsember 2012, kell 16:29

2012-12-17T16:29:38Z

←Vanem redaktsioon		Redaktsioon: 17. detsember 2012, kell 18:29
4. rida:		4. rida:

	== Announcements ==		== Announcements ==
			[https://docs.google.com/spreadsheet/viewform?fromEmail=true&formkey=dHdUalZhZ3JyX2lVV0llVmV MW2 Openbook quiz]


11. rida:		11. rida:
	Windows images for first lab :		Windows images for first lab :
	[http://www.tud.ttu.ee/im/Toomas.Lepik/ Windows images and other files in future ]		[http://www.tud.ttu.ee/im/Toomas.Lepik/ Windows images and other files in future ]

			=== Lab5 ===

			[http://www.tud.ttu.ee/im/Toomas.Lepik/mw2lab5.cap capture (live)]


			Where , what , when and so on.

			27.12.2012




	=== Lab4 ===		=== Lab4 ===
103. rida:		115. rida:
	=== 2012.11.26 [https://docs.google.com/presentation/d/1ykaKsFfCXRBRY0z7LloFO6Ir_75Y5cXR3wrPyrQ4WI0/edit Packing and stuff] ===		=== 2012.11.26 [https://docs.google.com/presentation/d/1ykaKsFfCXRBRY0z7LloFO6Ir_75Y5cXR3wrPyrQ4WI0/edit Packing and stuff] ===
	=== 2012.12.03 [https://docs.google.com/presentation/d/1q8JyJjT8e7UiO8v_ll1vxkBf9MuGtbqFR7Nrns8HZm0/edit Malicious document] ===		=== 2012.12.03 [https://docs.google.com/presentation/d/1q8JyJjT8e7UiO8v_ll1vxkBf9MuGtbqFR7Nrns8HZm0/edit Malicious document] ===


	=== 2012.12.10 [https://docs.google.com/presentation/d/1fLDhmwNiyoVktMCdir9cPPj7kB5PFIBQEnOHgZslMn8/edit Mobile malware] ===		=== 2012.12.10 [https://docs.google.com/presentation/d/1fLDhmwNiyoVktMCdir9cPPj7kB5PFIBQEnOHgZslMn8/edit Mobile malware] ===
			=== 2012.12.17 [https://docs.google.com/presentation/d/1a0hcHqbFBLvqdTu0N6is5JQvTtuZxvdeJfnLk--Jvwc/edit Endex ] ===

Lepik – 12. detsember 2012, kell 03:56

2012-12-12T03:56:26Z

←Vanem redaktsioon		Redaktsioon: 12. detsember 2012, kell 05:56
25. rida:		25. rida:
	Identify possible mitigation methods		Identify possible mitigation methods

			==== Deadline 17.12.2012 ====

	=== Lab3 ===		=== Lab3 ===

Lepik – 12. detsember 2012, kell 03:55

2012-12-12T03:55:01Z

@@ 12. rida: / 12. rida: @@
 [http://www.tud.ttu.ee/im/Toomas.Lepik/  Windows images and other files in future ]
@@ 89. rida: / 101. rida: @@
 === 2012.11.19 [https://docs.google.com/presentation/d/1Sn0sCcZTqmKLW6kpHvkGHqoqsYseAA75DEMnP1AKKRU/edit tools IDA and so on ] ===
 === 2012.11.26 [https://docs.google.com/presentation/d/1ykaKsFfCXRBRY0z7LloFO6Ir_75Y5cXR3wrPyrQ4WI0/edit Packing and stuff] ===

Lepik – 3. detsember 2012, kell 15:00

2012-12-03T15:00:01Z

←Vanem redaktsioon		Redaktsioon: 3. detsember 2012, kell 17:00
12. rida:		12. rida:
	[http://www.tud.ttu.ee/im/Toomas.Lepik/ Windows images and other files in future ]		[http://www.tud.ttu.ee/im/Toomas.Lepik/ Windows images and other files in future ]



			=== Lab3 ===

			4 executables that youre tested in Malware 1 are they packed / encrypted ?

			What makes you say so ? (how you determined)

			What kind of packing was used (if could be tetermined) ideas how to unpack them ?

			if no packing/encryption was used research one of thees packing metodologyes :

			1) FSG: Simple packer for Win32. Compression: aplib (LZ-based)
			2) MEW: Simple packer for Win32 (aplib)
			3) NSPACK: Simple packer for Win32 (LZMA)
			4) UPACK: Simple packer for Win32 (aplib)

			choose according to student number

			if last digits are 1 and 2 take 1
			if last digits are 3 and 4 take 2
			if last digits are 5,6,7 take 3
			if last digits are 8,9,0 take 4



			==== Deadline 10.12.2012 ====

Lepik – 26. november 2012, kell 16:48

2012-11-26T16:48:23Z

@@ 11. rida: / 11. rida: @@
 Windows images for  first lab :
 [http://www.tud.ttu.ee/im/Toomas.Lepik/  Windows images and other files in future ]
 === Lab1 ===
@@ 34. rida: / 47. rida: @@
 === 012.11.05 ===
 == LECTURES ==
@@ 41. rida: / 58. rida: @@
 === 2012.10.29 [https://docs.google.com/presentation/d/1r9BJzwpM23c1tKtgw6h67TAtrzExEUAHMkFiDNZ5Wyk/edit First lecture/ Introduction] ===
 === 2012.11.05 [https://docs.google.com/presentation/d/1Z8IoNerryfaFLZFoMfNyItzCM8dhsh4QWfp6AtY_e38/edit  sysinternal tools] ===

Lepik – 12. november 2012, kell 16:27

2012-11-12T16:27:42Z

←Vanem redaktsioon		Redaktsioon: 12. november 2012, kell 18:27
12. rida:		12. rida:
	[http://www.tud.ttu.ee/im/Toomas.Lepik/ Windows images and other files in future ]		[http://www.tud.ttu.ee/im/Toomas.Lepik/ Windows images and other files in future ]

			=== Lab1 ===
			Find malware

			describe your findings acording :
			http://computer-forensics.sans.org/blog/2012/05/08/writing-malware-reports

			Considerng following:

			does malware access internet - where

			How many diferent malware breads were in computer

			which files are interesting and sould considered target to deeper analysis

			whatewer els you could find about infections

			how to disinfect

			==== Deadline 21.11.2012 ====
			Be aware - downloading images takes time !

	=== 012.11.05 ===		=== 012.11.05 ===

Lepik: Uus lehekülg: '== About == == Announcements == == LABS/Homework == Windows images for first lab : [http://www.tud.ttu.ee/im/Toomas.Lepik/ Windows images and other files in future ] =...'

2012-11-07T02:38:33Z

Uus lehekülg: '== About == == Announcements == == LABS/Homework == Windows images for first lab : [http://www.tud.ttu.ee/im/Toomas.Lepik/ Windows images and other files in future ] =...'

Uus lehekülg

== About ==

== Announcements ==

== LABS/Homework ==

Windows images for first lab :
[http://www.tud.ttu.ee/im/Toomas.Lepik/ Windows images and other files in future ]

=== 012.11.05 ===

== LECTURES ==

Moust of things are in google dock

=== 2012.10.29 [https://docs.google.com/presentation/d/1r9BJzwpM23c1tKtgw6h67TAtrzExEUAHMkFiDNZ5Wyk/edit First lecture/ Introduction] ===
=== 2012.11.05 [https://docs.google.com/presentation/d/1Z8IoNerryfaFLZFoMfNyItzCM8dhsh4QWfp6AtY_e38/edit sysinternal tools] ===