Malware:ITX8060:2011:LAB1 - Redigeerimiste ajalugu

Toomasl: /* Milestone: 30.11.2011 - 00:00 */

2011-11-23T20:48:11Z

Milestone: 30.11.2011 - 00:00

←Vanem redaktsioon		Redaktsioon: 23. november 2011, kell 22:48
1. rida:		1. rida:
	==== Find out what is wrong. ====		==== Find out what is wrong. ====

	==== Milestone: 30.11.2011 - 00:00 ====		==== Milestone: 01.12.2011 - 00:00 ====

	should be sent to course-malware(at)cert.ee		should be sent to course-malware(at)cert.ee

Toomasl – 23. november 2011, kell 16:20

2011-11-23T16:20:49Z

←Vanem redaktsioon		Redaktsioon: 23. november 2011, kell 18:20
34. rida:		34. rida:
	Exercise can be done with partner		Exercise can be done with partner

	* Find out what is infecting win1		* Find out what is infecting the machine win1
	* Understand ~~what~~ way the current malware~~(s) are~~ dangerous to "your organisation"		* Understand which way is the current malware dangerous to "your organisation"
	* If possible clean win1		* If possible, do clean win1
	* Is win2 clean or has it problems ?		* Is win2 clean or it has problems, too?
	* If needed clean win2		* If needed, do clean win2


45. rida:		45. rida:
	Questions that answers should be visible !.		Questions that answers should be visible !.

	*Summary -Your ~~thought~~ about exercise ~~and sort~~ summary		*Summary - Your thoughts about the exercise. Please provide a short summary
	* Malware that infects machines		* Malware that infects machines
	- Md5 ~~has~~ -if it possible and if not why		- Md5 hash - if it possible and if not, please explain, why.
	- Sha256 has -if it possible and if not why		- Sha256 has -if it possible and if not, then please explain, why.
	- ~~Description how~~ that malware is threat to "You organization"		- A description - in which way that malware is a threat to "You organization"
	* Tools You used to find infection		* Tools You used to find the infection(s)
	* Tools You used clean machine		* Tools You used to clean machine(s)
	* Where You found hints and how You did it (you need to show Your thought		* Where You found hints and how exactly You did it (you need to show Your thought
	and communication process - write summary of it.)		and communication process - please write a summary of it.)
	* how would you ~~grade you~~ partner.		* how would you evaluate your partner.

	~~Pleas~~ consider		Please consider
	[http://zeltser.com/reverse-malware/malware-analysis-report-template.mm malware analysis report reminders ]		[http://zeltser.com/reverse-malware/malware-analysis-report-template.mm malware analysis report reminders ]

Toomasl: /* Milestone: 30.11.2011 - 00:00 */

2011-11-23T16:13:36Z

Milestone: 30.11.2011 - 00:00

←Vanem redaktsioon		Redaktsioon: 23. november 2011, kell 18:13
7. rida:		7. rida:
	File mname Sould be "studentnumber".Firstname.Lab1.(txt.odt.pdf....)		File mname Sould be "studentnumber".Firstname.Lab1.(txt.odt.pdf....)

	If you did it together		If you did it together
	Subject should be : "studentnumber".Firstname."studentnumber2".Firstname2.Lab1
			Subject should be : "studentnumber".Firstname."studentnumber2".Firstname2.Lab1

Toomasl – 23. november 2011, kell 16:13

2011-11-23T16:13:08Z

Uus lehekülg

==== Find out what is wrong. ====

==== Milestone: 30.11.2011 - 00:00 ====

should be sent to course-malware(at)cert.ee
Subject should be : "studentnumber".Firstname.Lab1
File mname Sould be "studentnumber".Firstname.Lab1.(txt.odt.pdf....)

If you did it together
Subject should be : "studentnumber".Firstname."studentnumber2".Firstname2.Lab1

There is 2 "computers" one of them are definitely infected second one i'm not sure about.

images for virtualbox can be downloaded

=====Bittorrent tracker=====

[http://suvaline.net/zyx/rivettracker/torrents/win1.ova.torrent Win1]

[http://suvaline.net/zyx/rivettracker/torrents/win2.ova.torrent Win2]

=====Http download=====

[https://sim.cert.ee/hw/win1.ova Win1]

[https://sim.cert.ee/hw/win2.ova Win2]

===== Assignment =====

Exercise can be done with partner

* Find out what is infecting win1
* Understand what way the current malware(s) are dangerous to "your organisation"
* If possible clean win1
* Is win2 clean or has it problems ?
* If needed clean win2

===== Deliverables =====

Questions that answers should be visible !.

*Summary -Your thought about exercise and sort summary
* Malware that infects machines
- Md5 has -if it possible and if not why
- Sha256 has -if it possible and if not why
- Description how that malware is threat to "You organization"
* Tools You used to find infection
* Tools You used clean machine
* Where You found hints and how You did it (you need to show Your thought
and communication process - write summary of it.)
* how would you grade you partner.

Pleas consider
[http://zeltser.com/reverse-malware/malware-analysis-report-template.mm malware analysis report reminders ]