https://www.botnets.fr/index.php?action=history&feed=atom&title=Malware_Memory_Analysis_-_VolatilityMalware Memory Analysis - Volatility - Revision history2026-10-24T01:49:27ZRevision history for this page on the wikiMediaWiki 1.43.11https://www.botnets.fr/index.php?title=Malware_Memory_Analysis_-_Volatility&diff=2177&oldid=prevEric.freyssinet: 1 revision imported2015-02-07T14:24:21Z<p>1 revision imported</p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:24, 7 February 2015</td>
</tr><tr><td colspan="4" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div>
</td></tr>
<!-- diff cache key wiki:diff:1.41:old-2176:rev-2177 -->
</table>Eric.freyssinethttps://www.botnets.fr/index.php?title=Malware_Memory_Analysis_-_Volatility&diff=2176&oldid=prevEric.freyssinet: Remplacement du texte — « Zeus » par « ZeuS »2012-10-20T09:16:38Z<p>Remplacement du texte — « Zeus » par « ZeuS »</p>
<p><b>New page</b></p><div>{{Publication<br />
|Image=<br />
|Legend=<br />
|Document=<br />
|Licence=<br />
|Video=<br />
|Link=http://blog.basementpctech.com/2012/04/in-acquiring-memory-blog-list-of-tools.html blog.basementpctech.com<br />
|Author=Basement Tech, <br />
|NomRevue=<br />
|Date=Saturday, April 14, 2012<br />
|Editor=Basement PC Tech<br />
|Year=2012<br />
|ISBN=<br />
|Page=<br />
|Abstract=In the Acquiring Memory blog a list of tools that could be used to acquire the memory of a live system was listed. Once you have successfully acquire the memory of the system, a tool like volatility can be used to analyze the memory for data. In this assessment I will be evaluating the memory sample as a person that has no formal training in memory analysis or on how to use the tool to see if I can still use the tool to identify malicious code contain within the memory image. For this test the ZeuS memory sample acquired from the Google Code – Volatility Memory Sample page will be used.<br />
<br />
I will use practical troubleshooting steps to established my approach of analyzing the memory sample.<br />
<br />
Look for strange processes<br />
Look for strange network connections<br />
Check registry for strange entries added by the malicious code.<br />
Analyze suspicious code<br />
|Botnet=, <br />
|Malware=Zbot, <br />
|CCProtocol=, <br />
|Operation=, <br />
|Keyword=Volatility, <br />
}}</div>Eric.freyssinet