View source for Detecting extended attributes (ZeroAccess) and other Frankenstein’s monsters with HMFT

{{Publication
|Link=http://www.hexacorn.com/blog/2013/01/25/detecting-extended-attributes-zeroaccess-and-other-frankensteins-monsters-with-hmft/
|Site=www.hexacorn.com
|NomRevue=Hexacorn blog
|Date=2013-01-25
|Editor=Hexacorn
|Year=2013
|Botnet=ZeroAccess
|Abstract=Similarly to Corey, I was very interested in researching EA, and I finally took some time tonight to have a deeper look at it myself. I actually wanted to dig in the code more than the $MFT artifacts alone not only to have something to write about (after all, Corey already covered everything!  ), but also because I wanted to see how the EA is actually created and what system functions/APIs are used by malware. The reason behind this curiosity was improvement of my analysis tools and techniques, and a few other ideas that I will be quiet about for the moment.
}}