Complex malware & forensics investigation
Description
This presentation explains how malware analyst and forensic investigator can work together. The purpose is to select several advanced threats (for example, Uroburos, ComRAT, Babar, Casper…) and to show how a reverser and a forensic investigator can be complementary.
The presentation is mainly based on the open source tool FastIR Collector developed by SEKOIA and available on Github. The presentation will present what kinds of artifacts the tools is able to collect and how to identify the infection.
Paul Rascagnères
Paul Rascagnères is a malware analyst and researcher for the Sekoia’s CERT. He is specialized in Advanced Persistant Threat (APT) and incident response. He worked on several complex cases such as government linked malware or rootkits analysis. He is a worldwide speaker at several security events.
Sébastien Larinier
Sébastien Larinier currently is Senior Researcher and CTO at the CERT Sekoia located in Paris, member of the honeyproject chapter France and co organizer of botconf. Sébastien focused his work for the last 5 years on botnet hunting, early compromission detection, forensic and incident response. Python addict he supports different opensource projects like FastResponder, OSINT Framework, Malcom.
