Edit Publication: Detecting extended attributes (ZeroAccess) and other Frankenstein’s monsters with HMFT

You do not have permission to edit this page, for the following reason:

The action you have requested is limited to users in the group: Users.

Image:
Legend:
Botnet:
Malware:
Exploit kit:
Services:
Target:
Origin:
Campaign:
Feature:
Strings:
Distribution vector:
Vulnerability:
CCProtocol:
Programming language:
Botnet/malware group:
Operation/working group:
Year:
Date:
Editor/Conference:
Link:
DOI:
Author:
Type:
Abstract:	Similarly to Corey, I was very interested in researching EA, and I finally took some time tonight to have a deeper look at it myself. I actually wanted to dig in the code more than the $MFT artifacts alone not only to have something to write about (after all, Corey already covered everything! ), but also because I wanted to see how the EA is actually created and what system functions/APIs are used by malware. The reason behind this curiosity was improvement of my analysis tools and techniques, and a few other ideas that I will be quiet about for the moment.

Free text:

Summary:

This is a minor edit

Watch this page