I’ve posted about dynamic and automated analysis of the Zeus malware, but what about identifying Zeus from firewall & IDS logs? After executing Zeus, my Sophos UTM generated a few alerts. This is something that would absolutely stick out to me during daily log analysis. Drilling into the alert tells us threat “C2/Zaccess-A” attempted to … Continue reading "Zeus Malware Analysis- Sophos UTM, Security Onion"
Read MoreCategory: File Analysis
Zeus Malware Analysis- Any.Run
I decided to run the Zeus Malware through an automated analysis tool and compare to what I saw using dynamic analysis with Remnux. I’m using the malware analysis tool at app.any.run The free version only supports Windows 7 executables, which Zeus targets. After uploading the file, app.any.run displays a windows UI and what the malware … Continue reading "Zeus Malware Analysis- Any.Run"
Read MoreZeus Malware Analysis- Remnux
Today we’re looking at dynamic malware analysis of Zeus with Remnux Linux. I wanted to RE a windows file this week, and am just not getting anything good on my RDP honeypot (yet). I thought, what better way to start windows malware analysis than with a old piece of malware? That way if I’m missing … Continue reading "Zeus Malware Analysis- Remnux"
Read MoreELF Analysis- kiga.x86
In addition to my weekly threat intel report, I’ll highlight a file/executable/exploit attempt seen in the last week. I’ll do some basic file analysis to better understand what it is, and what it’s trying to accomplish. Hopefully this can provide contextual data for those doing their own research. This week we’re looking at kiga.x86. Using … Continue reading "ELF Analysis- kiga.x86"
Read MoreScript Analysis- yoyobins.sh
In addition to my weekly threat intel report, I want to highlight a particular file/executable/exploit attempt I saw in the last week. I’ll do some basic analysis of the file to better understand what it is, and what it’s trying to accomplish. Hopefully this can provide contextual data for those doing their own research. This … Continue reading "Script Analysis- yoyobins.sh"
Read More