Malware:ITX8060:2011:LAB1: erinevus redaktsioonide vahel
Mine navigeerimisribale
Mine otsikasti
| (ei näidata sama kasutaja üht vahepealset redaktsiooni) | |||
| 1. rida: | 1. rida: | ||
==== Find out what is wrong. ==== | ==== Find out what is wrong. ==== | ||
==== Milestone: | ==== Milestone: 01.12.2011 - 00:00 ==== | ||
should be sent to course-malware(at)cert.ee | should be sent to course-malware(at)cert.ee | ||
| 34. rida: | 34. rida: | ||
Exercise can be done with partner | Exercise can be done with partner | ||
* Find out what is infecting win1 | * Find out what is infecting the machine win1 | ||
* Understand | * Understand which way is the current malware dangerous to "your organisation" | ||
* If possible clean win1 | * If possible, do clean win1 | ||
* Is win2 | * Is win2 clean or it has problems, too? | ||
* If needed clean win2 | * If needed, do clean win2 | ||
| 45. rida: | 45. rida: | ||
Questions that answers should be visible !. | Questions that answers should be visible !. | ||
*Summary -Your | *Summary - Your thoughts about the exercise. Please provide a short summary | ||
* Malware that infects machines | * Malware that infects machines | ||
- Md5 | - Md5 hash - if it possible and if not, please explain, why. | ||
- Sha256 has -if it possible and if not why | - Sha256 has -if it possible and if not, then please explain, why. | ||
- | - A description - in which way that malware is a threat to "You organization" | ||
* Tools You used to find infection | * Tools You used to find the infection(s) | ||
* Tools You used clean machine | * Tools You used to clean machine(s) | ||
* Where You found hints and how You did it (you need to show Your thought | * Where You found hints and how exactly You did it (you need to show Your thought | ||
and communication process - write summary of it.) | and communication process - please write a summary of it.) | ||
* how would you | * how would you evaluate your partner. | ||
Please consider | |||
[http://zeltser.com/reverse-malware/malware-analysis-report-template.mm malware analysis report reminders ] | [http://zeltser.com/reverse-malware/malware-analysis-report-template.mm malware analysis report reminders ] | ||
Viimane redaktsioon: 23. november 2011, kell 22:48
Find out what is wrong.
Milestone: 01.12.2011 - 00:00
should be sent to course-malware(at)cert.ee Subject should be : "studentnumber".Firstname.Lab1 File mname Sould be "studentnumber".Firstname.Lab1.(txt.odt.pdf....)
If you did it together
Subject should be : "studentnumber".Firstname."studentnumber2".Firstname2.Lab1
There is 2 "computers" one of them are definitely infected second one i'm not sure about.
images for virtualbox can be downloaded
Bittorrent tracker
Http download
Assignment
Exercise can be done with partner
* Find out what is infecting the machine win1 * Understand which way is the current malware dangerous to "your organisation" * If possible, do clean win1 * Is win2 clean or it has problems, too? * If needed, do clean win2
Deliverables
Questions that answers should be visible !.
*Summary - Your thoughts about the exercise. Please provide a short summary * Malware that infects machines - Md5 hash - if it possible and if not, please explain, why. - Sha256 has -if it possible and if not, then please explain, why. - A description - in which way that malware is a threat to "You organization" * Tools You used to find the infection(s) * Tools You used to clean machine(s) * Where You found hints and how exactly You did it (you need to show Your thought and communication process - please write a summary of it.) * how would you evaluate your partner.
Please consider malware analysis report reminders