Malware:ITX8042:2011:LAB - Redigeerimiste ajalugu

Toomasl – 6. oktoober 2011, kell 18:19

2011-10-06T18:19:05Z

←Vanem redaktsioon		Redaktsioon: 6. oktoober 2011, kell 20:19
9. rida:		9. rida:
	Download a file [https://sim.cert.ee/hw/pahadus.zip pahadus.zip]		Download a file [https://sim.cert.ee/hw/pahadus.zip pahadus.zip]

	==WARNING FILE CONTAINS LIVE VIRUSES==		'''WARNING FILE CONTAINS LIVE VIRUSES'''

	Take from there three files from 90 files		Take from there three files from 90 files
15. rida:		15. rida:
	Pick from 90 files 3 files by next algorithm		Pick from 90 files 3 files by next algorithm

	1) sort them by name.		#sort them by name.
			#first use last number of your student code + your birthday-s day
	2) first use last number of your student code + your birthday-s day		#for second generate random number http://www.random.org/ and only if it does not mach first number use it for choosing the file
			#for third use random number generator again and if it does not mach first or second number use it.
	3) for second generate random number http://www.random.org/ and only if it does not mach first number use it for choosing the file

	4)for third use random number generator again and if it does not mach first or second number use it.


40. rida:		37. rida:
	* chosen numbers		* chosen numbers
	* general information about malware		* general information about malware
	name		**name
	md5		**md5
	sha1		**sha1
	* link to analysis result if it is possible		* link to analysis result if it is possible
	* link to disinfecting instructions -if not possible explanation why it is not.		* link to disinfecting instructions -if not possible explanation why it is not.

Toomasl – 6. oktoober 2011, kell 18:12

2011-10-06T18:12:29Z

←Vanem redaktsioon		Redaktsioon: 6. oktoober 2011, kell 20:12
7. rida:		7. rida:
	==== Milestone: 14.10.2011 - 15:00 EET ====		==== Milestone: 14.10.2011 - 15:00 EET ====

	Download a file [ https://sim.cert.ee/hw/pahadus.zip pahadus.zip ]		Download a file [https://sim.cert.ee/hw/pahadus.zip pahadus.zip]

	==WARNING FILE CONTAINS LIVE VIRUSES==		==WARNING FILE CONTAINS LIVE VIRUSES==

			Take from there three files from 90 files

			Pick from 90 files 3 files by next algorithm

			1) sort them by name.

			2) first use last number of your student code + your birthday-s day

			3) for second generate random number http://www.random.org/ and only if it does not mach first number use it for choosing the file

			4)for third use random number generator again and if it does not mach first or second number use it.


			==== Tasks that you need to do ====

			* Pick you malware
			* Run your malware againtst 2 of next online analysis tools

			http://www.virustotal.com
			http://camas.comodo.com/
			http://www.threatexpert.com/submit.aspx

			* find additional 2 online analysis tools where to analyze virus


	===== Things that should be presented =====		===== Things that should be presented =====

	* ~~My externeal ip- where from i try to do this work (you can omit last 8 bytes)~~		* chosen numbers
	* ~~My ISP~~		* general information about malware
	~~* My ISP AS number and abuse adress*~~		name
			md5
	~~atleast 3 times (wil send 3 or mo ip-is)~~		sha1
	* ~~Route~~ to ip		* link to analysis result if it is possible
	* ~~Hostname~~ - ~~in your best knowledge~~.		* link to disinfecting instructions -if not possible explanation why it is not.
	* ~~ISP~~-~~s upstream ISP for given IP~~		* Analysis tools -links
	* Abuse contact for IP and contact for national CERT whose constituency this IP belongs to.		* Your opinion about each analysis tool and comparison results.
	* ~~Do i need any additional information besides knowing my problem~~ and ~~ip to send abuse to this ISP and why~~.

	* tools and or Websites you used to gather this information

Toomasl – 6. oktoober 2011, kell 15:52

2011-10-06T15:52:33Z

←Vanem redaktsioon		Redaktsioon: 6. oktoober 2011, kell 17:52
1. rida:		1. rida:
	= Labs =		= Labs =

			== 4 Lab/Home assignment ==

			==== Is this a malware how yo knew ? and how to analyse ? ====

			==== Milestone: 14.10.2011 - 15:00 EET ====

			Download a file [ https://sim.cert.ee/hw/pahadus.zip pahadus.zip ]

			==WARNING FILE CONTAINS LIVE VIRUSES==


			===== Things that should be presented =====

			* My externeal ip- where from i try to do this work (you can omit last 8 bytes)
			* My ISP
			* My ISP AS number and abuse adress*

			atleast 3 times (wil send 3 or mo ip-is)
			* Route to ip
			* Hostname - in your best knowledge.
			* ISP-s upstream ISP for given IP
			* Abuse contact for IP and contact for national CERT whose constituency this IP belongs to.
			* Do i need any additional information besides knowing my problem and ip to send abuse to this ISP and why.

			* tools and or Websites you used to gather this information



	== 3 Lab/Home assignment ==		== 3 Lab/Home assignment ==

Toomasl – 6. oktoober 2011, kell 15:44

2011-10-06T15:44:51Z

←Vanem redaktsioon		Redaktsioon: 6. oktoober 2011, kell 17:44
30. rida:		30. rida:


	==== Milestone: ~~26th~~ 2011 12:00EET ====		==== Milestone: 26.09.2011 12:00EET ====

	Results to tarmo at cert dot ee cc course-malware(at)cert.ee		Results to tarmo at cert dot ee cc course-malware(at)cert.ee


	for Malware2 optional = requiered and for requiered dedline is 15 now		for Malware2 optional = requiered and for requiered dedline is 15 now


	[https://sim.cert.ee/hw/ ~~Presentation and home work~~ ]		Primary task
			• extract disk image of your or your friends thumbdrive / sd ( / cf) card
			• analyze disk image
			• document the process
			• selection of tools and howtos is [http://www.forensics.nl/tools here] and [http://www.forensicswiki.org/ here]

			Required for those taking Malware 2 and Bonus for others
			• analyze mobile malware file [https://sim.cert.ee/hw/mmc.jar mmc.jar]
			• unpack it (hint - use zip on .jar)
			• examine .class files using tool available [http://java.decompiler.free.fr/?q=jdgui here ]
			• find code sending SMSes using 'sms://' URI
			• XTRA points - calculate short number used in SM.send
			• document the process

Toomasl – 29. september 2011, kell 18:01

2011-09-29T18:01:38Z

@@ 1. rida: / 1. rida: @@
 = Labs =
 ==  1 Lab/Home assignment ==
@@ 7. rida: / 49. rida: @@
 ==== Milestone: 8.10.2011 - 20:00 ====
-should be sent to course-malware@cert.ee
+should be sent to course-malware(at)cert.ee

Toomasl: /* Milestone: 8.10.2011 - 20:00 */

2011-09-19T01:34:24Z

Milestone: 8.10.2011 - 20:00

←Vanem redaktsioon		Redaktsioon: 19. september 2011, kell 03:34
11. rida:		11. rida:

	Find out how much costs		Find out how much costs
	* DDOS ,		* DDOS ,
	* credit card number ,		* credit card number ,
	* ~~infecting the~~ machine,		* infected machine ,
	* sending spam for 1 000 000 people,		* sending spam for 1 000 000 people,

			Hints :

			Knowing Russian slang for that will be beneficial
			and there are other search engines beside google.

Toomasl – 15. september 2011, kell 13:10

2011-09-15T13:10:53Z

Uus lehekülg

= Labs =

== 1 Lab/Home assignment ==

==== Assignment: Be a Search master and good infiltrator ====

==== Milestone: 8.10.2011 - 20:00 ====

should be sent to course-malware@cert.ee

Find out how much costs
* DDOS ,
* credit card number ,
* infecting the machine,
* sending spam for 1 000 000 people,

===== Things that should be presented =====

* Where you found information (links or sources)
* IM ,AMI forum or whatever contact you have for person whom you can acquire such thing
* Prices
and what ever other information you find relavent.