Complex malware & forensics investigation
Key | Action |
---|---|
K or space | Play / Pause |
M | Mute / Unmute |
C | Select next subtitles |
A | Select next audio track |
V | Show slide in full page or toggle automatic source change |
left arrow | Seek 5s backward |
right arrow | Seek 5s forward |
shift + left arrow or J | Seek 10s backward |
shift + right arrow or L | Seek 10s forward |
control + left arrow | Seek 60s backward |
control + right arrow | Seek 60s forward |
shift + down arrow | Decrease volume |
shift + up arrow | Increase volume |
shift + comma | Decrease playback rate |
shift + dot or shift + semicolon | Increase playback rate |
end | Seek to end |
beginning | Seek to beginning |
Share this media
Download links
HLS video stream
You can use an external player to play this stream (like VLC).
HLS video streamInformation on this media
Links:
Number of views:
59Creation date:
July 6, 2016Speakers:
Paul Rascagnères & Sébastien LarinierCompany:
RMLLLicense:
CC BY SA v4Description
This presentation explains how malware analyst and forensic investigator can work together. The purpose is to select several advanced threats (for example, Uroburos, ComRAT, Babar, Casper…) and to show how a reverser and a forensic investigator can be complementary.
The presentation is mainly based on the open source tool FastIR Collector developed by SEKOIA and available on Github. The presentation will present what kinds of artifacts the tools is able to collect and how to identify the infection.
Paul Rascagnères
Paul Rascagnères is a malware analyst and researcher for the Sekoia’s CERT. He is specialized in Advanced Persistant Threat (APT) and incident response. He worked on several complex cases such as government linked malware or rootkits analysis. He is a worldwide speaker at several security events.
Sébastien Larinier
Sébastien Larinier currently is Senior Researcher and CTO at the CERT Sekoia located in Paris, member of the honeyproject chapter France and co organizer of botconf. Sébastien focused his work for the last 5 years on botnet hunting, early compromission detection, forensic and incident response. Python addict he supports different opensource projects like FastResponder, OSINT Framework, Malcom.
Other media in the channel "Sécurité"
86 viewsMOWR, A virustotal-like service for web malwaresAugust 7th, 2016
272 views, 1 this monthMIG: Investigate 1,000 endpoints in 10sAugust 8th, 2016
129 views, 1 this monthUsing and abusing MISP to track campaignsAugust 7th, 2016
18 viewsBuilding A Poor man’s Fir3Ey3 Mail ScannerAugust 8th, 2016
16 viewsHands-on security for DIY projectsAugust 7th, 2016
17 viewsLightning talk about Server Side TLSAugust 7th, 2016