Malware:ITX8060:2012: erinevus redaktsioonide vahel
Mine navigeerimisribale
Mine otsikasti
Resümee puudub |
Resümee puudub |
||
| (ei näidata sama kasutaja 6 vahepealset redaktsiooni) | |||
| 4. rida: | 4. rida: | ||
== Announcements == | == Announcements == | ||
[https://docs.google.com/spreadsheet/viewform?fromEmail=true&formkey=dHdUalZhZ3JyX2lVV0llVmVvZDMzZkE6MQ MW2 Openbook quiz] | |||
| 11. rida: | 11. rida: | ||
Windows images for first lab : | Windows images for first lab : | ||
[http://www.tud.ttu.ee/im/Toomas.Lepik/ Windows images and other files in future ] | [http://www.tud.ttu.ee/im/Toomas.Lepik/ Windows images and other files in future ] | ||
=== Lab5 === | |||
[http://www.tud.ttu.ee/im/Toomas.Lepik/mw2lab5.cap capture (live)] | |||
Where , what , when and so on. | |||
==== Deadline 27.12.2012 ==== | |||
=== Lab4 === | |||
[http://www.tud.ttu.ee/im/Toomas.Lepik/mobilemw.zip 2 android malwares (live)] | |||
W2hich permissions does malwares acquire? | |||
Describe the intent filter feature | |||
Describe the functionality of the malwares | |||
SHA SUM of the APK | |||
Which network connections does themalware initiate? | |||
To which purpose? | |||
Name of the malware | |||
Identify possible mitigation methods | |||
==== Deadline 17.12.2012 ==== | |||
=== Lab3 === | |||
4 executables that youre tested in Malware 1 are they packed / encrypted ? | |||
What makes you say so ? (how you determined) | |||
What kind of packing was used (if could be tetermined) ideas how to unpack them ? | |||
if no packing/encryption was used research one of thees packing metodologyes : | |||
1) FSG: Simple packer for Win32. Compression: aplib (LZ-based) | |||
2) MEW: Simple packer for Win32 (aplib) | |||
3) NSPACK: Simple packer for Win32 (LZMA) | |||
4) UPACK: Simple packer for Win32 (aplib) | |||
choose according to student number | |||
if last digits are 1 and 2 take 1 | |||
if last digits are 3 and 4 take 2 | |||
if last digits are 5,6,7 take 3 | |||
if last digits are 8,9,0 take 4 | |||
==== Deadline 10.12.2012 ==== | |||
=== Lab2 === | |||
[http://www.tud.ttu.ee/im/Toomas.Lepik/mirc571t.exe Revers enginer mirc] | |||
[https://docs.google.com/presentation/d/1Sn0sCcZTqmKLW6kpHvkGHqoqsYseAA75DEMnP1AKKRU/edit a bit more exact explanation on what you sould do.] | |||
==== Deadline 03.12.2012 ==== | |||
=== Lab1 === | === Lab1 === | ||
| 34. rida: | 98. rida: | ||
=== 012.11.05 === | === 012.11.05 === | ||
== LECTURES == | == LECTURES == | ||
| 41. rida: | 109. rida: | ||
=== 2012.10.29 [https://docs.google.com/presentation/d/1r9BJzwpM23c1tKtgw6h67TAtrzExEUAHMkFiDNZ5Wyk/edit First lecture/ Introduction] === | === 2012.10.29 [https://docs.google.com/presentation/d/1r9BJzwpM23c1tKtgw6h67TAtrzExEUAHMkFiDNZ5Wyk/edit First lecture/ Introduction] === | ||
=== 2012.11.05 [https://docs.google.com/presentation/d/1Z8IoNerryfaFLZFoMfNyItzCM8dhsh4QWfp6AtY_e38/edit sysinternal tools] === | === 2012.11.05 [https://docs.google.com/presentation/d/1Z8IoNerryfaFLZFoMfNyItzCM8dhsh4QWfp6AtY_e38/edit sysinternal tools] === | ||
=== 2012.11.12 [https://docs.google.com/presentation/d/16GbBOi7E0vqO96T7mpZjf5CibOJSVLdvzVVr2w0Dhp4/edit 3 things +lab] === | |||
=== 2012.11.12 [https://docs.google.com/presentation/d/1YYMwy5gWqWbWyCz9N9qgbLwQcUFB80q_oVtnQAm7p08/edit intro to Assembli languatage] === | |||
=== 2012.11.19 [https://docs.google.com/presentation/d/1Sn0sCcZTqmKLW6kpHvkGHqoqsYseAA75DEMnP1AKKRU/edit tools IDA and so on ] === | |||
=== 2012.11.26 [https://docs.google.com/presentation/d/1ykaKsFfCXRBRY0z7LloFO6Ir_75Y5cXR3wrPyrQ4WI0/edit Packing and stuff] === | |||
=== 2012.12.03 [https://docs.google.com/presentation/d/1q8JyJjT8e7UiO8v_ll1vxkBf9MuGtbqFR7Nrns8HZm0/edit Malicious document] === | |||
=== 2012.12.10 [https://docs.google.com/presentation/d/1fLDhmwNiyoVktMCdir9cPPj7kB5PFIBQEnOHgZslMn8/edit Mobile malware] === | |||
=== 2012.12.17 [https://docs.google.com/presentation/d/1a0hcHqbFBLvqdTu0N6is5JQvTtuZxvdeJfnLk--Jvwc/edit Endex ] === | |||
Viimane redaktsioon: 17. detsember 2012, kell 21:10
About
Announcements
LABS/Homework
Windows images for first lab : Windows images and other files in future
Lab5
Where , what , when and so on.
Deadline 27.12.2012
Lab4
W2hich permissions does malwares acquire? Describe the intent filter feature Describe the functionality of the malwares SHA SUM of the APK Which network connections does themalware initiate? To which purpose? Name of the malware Identify possible mitigation methods
Deadline 17.12.2012
Lab3
4 executables that youre tested in Malware 1 are they packed / encrypted ?
What makes you say so ? (how you determined)
What kind of packing was used (if could be tetermined) ideas how to unpack them ?
if no packing/encryption was used research one of thees packing metodologyes :
1) FSG: Simple packer for Win32. Compression: aplib (LZ-based) 2) MEW: Simple packer for Win32 (aplib) 3) NSPACK: Simple packer for Win32 (LZMA) 4) UPACK: Simple packer for Win32 (aplib)
choose according to student number
if last digits are 1 and 2 take 1
if last digits are 3 and 4 take 2
if last digits are 5,6,7 take 3
if last digits are 8,9,0 take 4
Deadline 10.12.2012
Lab2
a bit more exact explanation on what you sould do.
Deadline 03.12.2012
Lab1
Find malware
describe your findings acording : http://computer-forensics.sans.org/blog/2012/05/08/writing-malware-reports
Considerng following:
does malware access internet - where
How many diferent malware breads were in computer
which files are interesting and sould considered target to deeper analysis
whatewer els you could find about infections
how to disinfect
Deadline 21.11.2012
Be aware - downloading images takes time !
012.11.05
LECTURES
Moust of things are in google dock