Malware:ITX8060:2010:LAB

Labs

1 Lab/Home assignment

report should be sent to course-malware@cert.ee

This exercise is group exercise

Analyze infected machine

ftp://monitor.adamson.cc/win7nakkat.tgz

Pass:

Questions that should be answered

a) what kind of malware you found b) How you did it. c) Based on malware disinfection steps considering that you counterpart do not have anti virus

2 Lab/Home assignment

report should be sent to course-malware@cert.ee

This exercise is group exercise Presentations will be expected starting from 29 November

Build Black box environment - so you can enable network assess gradually and monitor network activity. Build Fake Email service - so boxed environment thinks he can send email Run 2 malware samples and try to determine

 a) To what ip-s or addresses  connections are made 
 b) if there is an authentication information try to determine domestication information 

Malware samples are available from ftp://monitor.adamson.cc/infected.zip password as usual.

Results should be

Group should demonstrate blaxbox environment and ability to gradualy allow network resources. presented in document should be building instruction (description of system) instructions how to manage network resources with this system. Description how email service was faked

Result of malware black box analysis.