https://www.botnets.fr/index.php?action=history&feed=atom&title=QuickPost%3A_Flame_%26_VolatilityQuickPost: Flame & Volatility - Revision history2026-10-24T01:27:41ZRevision history for this page on the wikiMediaWiki 1.43.11https://www.botnets.fr/index.php?title=QuickPost:_Flame_%26_Volatility&diff=2326&oldid=prevEric.freyssinet: 1 revision imported2015-02-07T14:27:05Z<p>1 revision imported</p>
<p><b>New page</b></p><div>{{Publication<br />
|Image=<br />
|Legend=<br />
|Document=<br />
|Licence=<br />
|Video=<br />
|Link=http://mnin.blogspot.fr/2012/06/quickpost-flame-volatility.html mnin.blogspot.com<br />
|Author=Michael Hale Ligh, <br />
|NomRevue=MNIN Security Blog <br />
|Date=June 29, 2012<br />
|Editor=<br />
|Year=2012<br />
|ISBN=<br />
|Page=<br />
|Abstract=After reading the very interesting Inside Flame article by IOActive's Ruben Santamarta, @bradarndt posed the question: can volatility find flame modules? My first reaction was of course it can...in fact CrySyS Lab used volatility in Section 3.3 Injections of their initial technical report. However, I figured it would be best to check and make sure before replying. In this blog post, I'll cover some simple steps to confirm an infection based on Ruben's VAD/shell32 discovery. <br />
|Botnet=Flame, <br />
|Malware=, <br />
|CCProtocol=, <br />
|Operation=, <br />
|Keyword=, <br />
}}</div>Eric.freyssinet