Archive for April, 2011
Week-in-Malware Review
by dave on Apr.12, 2011, under Malware
- Monthly update from Sophos: help get rid of IE6, avoid tsunami scams, check out Pwn2own, be surprised at RSA, and groan at Epsilon
- Team Cymru: Episode 98
- The Hacker News Network:
- Languy99′s Emsisoft Antimalware 5.1 Review:
- Languy99′s K7 Total Security Review:
- Matt Rizos on Using the Norton Bootable Removal Tool:
- XP/Vista/Win 7 Anti-Virus/Anti-Spyware/Home/Total/Internet Security 2011 Removal Guide by RogueAmp:
- Avast! Free Antivirus 6.0 Review and Malware Test by Cudgelwap1:
- Activation Ransom Trojan – by F-Secure
Reviving TRUMAN: Introducing NUMAN
by dave on Apr.10, 2011, under Minotaur
We’re going to start opening up about some of the projects we’re working on that we think will benefit the research community at large.
Minotaur is a lot of things to us internally. Mostly, it is an experimental platform for malware analysis. It contains a few different sandboxes and sandnets but it itself is not. The sandboxes just provide the data for the bigger projects.
Below, you are looking at the first screenshots of the internal platform, just recently constructed. The four-plex view is a view of several analyst workstations using mRemoteNG. The single screenshot is the result of our efforts to adapt TRUMAN to our environment, which was a serious challenge as not that much information exists on the TRUMAN SandNet at all. The current version of the project is something we’re calling NUMAN, since it is a new version of TRUMAN, and well, MUMAN sounded funny…
NUMAN is able to successfully run under proxmox and has a hybrid approach to the imaging required by a sandnet. If there is sufficient interest, we’d be happy to detail the steps we took and publish our changes. In some ways there’s almost nothing left of TRUMAN, and it has been replaced by our own code/methods.
Along with NUMAN, we are running 20 zerowine images in a queued system, and all samples deemed malicious are sent through that system and the data is parsed into our databases. We are looking for commonality in dropfiles, naming conventions, calls, packers, evasion technologies and many other attributes of each sample.
Analysts/researchers/volunteers are also given full remote desktop to workstations in the research network. A common wiki/portal for all research and information is called the “Oracle”
Access to the research network is provided by VPN, and we are accepting informal applications. If you are interested in access to the platform, or sharing samples, output, stats, etc, please let us know at info@novcon.net
More to come…
