Use the process described in a previous post to determine what the malware is doing. Under VMware 7.0 choose the Vm Menu ->Settingĩ.Select use existing virtual disk.
#Can prodiscover basic find dco install
Use the wizard and select typical machine, install OS later and Guest OS and take default setting on all the rest.Ħ.Select VM Settings.
vmdk file.ĥ.Create a new virtual machine.
#Can prodiscover basic find dco software
I could have used software such as Live View, but I wasn’t sure how well it worked with Linux as my host OS. I needed a quick way of determine the capabilities of the malware, so I decided to boot a copy of the original dd image using vmware and then do behavioral analysis on the system. I didn’t have time to run it through ollydbg or Ida Pro. The system had a nasty rootkit that was injecting code into a couple of processes. After building a timeline, I was able to determine that the initial infection vector had been deleted and the malware hosting site had been pulled off-line. In this instance, a number of different malware products had been ran, along with clearing temp files and Internet cache, but the system was still showing signs of infection. But, sometime you may need to do analysis on the system. Most of the time, I tell them the evidence has been trampled on by different malware scanning software and just re-image the system. Sometimes as an incident responder we get called on to analyze a system that has already been “looked at” by another admin or desktop support personnel.
0 kommentar(er)
