Eric.freyssinet: 1 revision imported

2015-02-07T14:24:19Z

1 revision imported

← Older revision		Revision as of 14:24, 7 February 2015
(No difference)

Eric.freyssinet: Eric.freyssinet a déplacé la page Zeus v2 Malware Analysis - Part II vers ZeuS v2 Malware Analysis - Part II sans laisser de redirection : Remplacement du texte — « Zeus » par « ZeuS »

2012-11-25T19:26:33Z

Eric.freyssinet a déplacé la page Zeus v2 Malware Analysis - Part II vers ZeuS v2 Malware Analysis - Part II sans laisser de redirection : Remplacement du texte — « Zeus » par « ZeuS »

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.sysforensics.org/2012/04/zeus-v2-malware-analysis-part-ii.html www.sysforensics.org
|Author=Patrick Olsen,
|NomRevue=
|Date=
|Editor=System Forensics
|Year=2012
|ISBN=
|Page=
|Abstract=ZeuS v2 Malware Analysis - Part II
Welcome back for Part II. I am going to be taking a look at memory forensics by way of Volatility.

Memory Forensics

Let's kick this section off by running the volatility command, "imageinfo". The imageinfo command does just that. It provides us the image information required so we can specify what profile to pass to volatility when we start running more commands against our image.

In our case this is what the results looked like:

So now we know that we are running Windows 7 Service Pack 1 on an x86 platform, which is correct. So when we run future commands we will specify --profile=Win7SP1x86.

When I am running volatility I will typically run pslist first. Let's do that and see what we can find.

|Botnet=,
|Malware=Zbot,
|CCProtocol=,
|Operation=,
|Keyword=,
}}

ZeuS v2 Malware Analysis - Part II - Revision history

Eric.freyssinet: 1 revision imported

Eric.freyssinet: Eric.freyssinet a déplacé la page Zeus v2 Malware Analysis - Part II vers ZeuS v2 Malware Analysis - Part II sans laisser de redirection : Remplacement du texte — « Zeus » par « ZeuS »