QuickPost: Flame & Volatility
Jump to navigation
Jump to search
(Publication) Google search: [1]
| QuickPost: Flame & Volatility | |
|---|---|
| Botnet | Flame |
| Malware | |
| Botnet/malware group | |
| Exploit kits | |
| Services | |
| Feature | |
| Distribution vector | |
| Target | |
| Origin | |
| Campaign | |
| Operation/Working group | |
| Vulnerability | |
| CCProtocol | |
| Date | 2012 / June 29, 2012 |
| Editor/Conference | |
| Link | http://mnin.blogspot.fr/2012/06/quickpost-flame-volatility.html mnin.blogspot.com (mnin.blogspot.com Archive copy) |
| Author | Michael Hale Ligh |
| Type | |
Abstract
“ After reading the very interesting Inside Flame article by IOActive's Ruben Santamarta, @bradarndt posed the question: can volatility find flame modules? My first reaction was of course it can...in fact CrySyS Lab used volatility in Section 3.3 Injections of their initial technical report. However, I figured it would be best to check and make sure before replying. In this blog post, I'll cover some simple steps to confirm an infection based on Ruben's VAD/shell32 discovery.
Bibtex
@misc{Lua error: Cannot create process: proc_open(/dev/null): failed to open stream: Operation not permitted2012BFR1062,
editor = {},
author = {Michael Hale Ligh},
title = {QuickPost: Flame & Volatility},
date = {29},
month = Jun,
year = {2012},
howpublished = {\url{http://mnin.blogspot.fr/2012/06/quickpost-flame-volatility.html mnin.blogspot.com}},
}