Malware:ITX8060:2012

Announcements

MW2 Openbook quiz

LABS/Homework

Windows images for first lab : Windows images and other files in future

Lab5

capture (live)

Where , what , when and so on.

Lab4

2 android malwares (live)

  W2hich permissions does malwares acquire?
  Describe the intent 	filter feature
  Describe the functionality of the malwares
  SHA SUM of the APK
  Which network connections does themalware initiate?
  To which purpose?
  Name of the malware
  Identify possible mitigation methods

Lab3

4 executables that youre tested in Malware 1 are they packed / encrypted ?

What makes you say so ? (how you determined)

What kind of packing was used (if could be tetermined) ideas how to unpack them ?

if no packing/encryption was used research one of thees packing metodologyes :

   1) FSG: Simple packer for Win32. Compression: aplib (LZ-based)
   2) MEW: Simple packer for Win32 (aplib) 
   3) NSPACK: Simple packer for Win32 (LZMA) 
   4) UPACK: Simple packer for Win32 (aplib)

choose according to student number

        if last  digits are  1 and 2  take 1 
        if  last digits  are 3 and 4  take 2
        if last  digits are  5,6,7    take 3
        if last digits are   8,9,0    take 4

Lab2

Revers enginer mirc

a bit more exact explanation on what you sould do.

Lab1

Find malware

describe your findings acording : http://computer-forensics.sans.org/blog/2012/05/08/writing-malware-reports

Considerng following:

does malware access internet - where 

How many diferent malware breads were in computer 

which files are interesting and sould considered target to deeper analysis

whatewer els you could find about infections

how to disinfect 

Deadline 21.11.2012

Be aware - downloading images takes time !

LECTURES

Moust of things are in google dock