Why reverse malware when you can just look in the RAM? - Dumping Malware Configuration Data from Memory http://www.ghettoforensics.com/2013/10/dumping-malware-configuration-data-from.html … #volatility
-
@tomchop_@bartblaze This is good, but doesn't it assume malware leaves config decrypted in memory instead of decrypt-use-erase behavior.
@TouchMyMalware @tomchop_ Yes it does. I think with the more primitive malware this could still prove to be successful.
-
-
@bartblaze@touchmymalware In my experience, getting configs from memory works fine with most banking malware. -
@tomchop_@bartblaze Yeah, most banking malware is based on old code like Zeus or written by lazy coders.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.