QuickPost: Flame & Volatility

(Publication) Google search: [1]

QuickPost: Flame & Volatility
Botnet	Flame
Malware
Botnet/malware group
Exploit kits
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group
Vulnerability
CCProtocol
Date	2012 / June 29, 2012
Editor/Conference
Link	http://mnin.blogspot.fr/2012/06/quickpost-flame-volatility.html mnin.blogspot.com (mnin.blogspot.com Archive copy)
Author	Michael Hale Ligh
Type

Abstract

“ After reading the very interesting Inside Flame article by IOActive's Ruben Santamarta, @bradarndt posed the question: can volatility find flame modules? My first reaction was of course it can...in fact CrySyS Lab used volatility in Section 3.3 Injections of their initial technical report. However, I figured it would be best to check and make sure before replying. In this blog post, I'll cover some simple steps to confirm an infection based on Ruben's VAD/shell32 discovery.

Bibtex

 @misc{Ligh2012BFR1062,
   editor = {},
   author = {Michael Hale Ligh},
   title = {QuickPost: Flame & Volatility},
   date = {29},
   month = Jun,
   year = {2012},
   howpublished = {\url{http://mnin.blogspot.fr/2012/06/quickpost-flame-volatility.html mnin.blogspot.com}},
 }