Irregular Expressions: August, 2012 archives Page 2

Working With Packed / Protected Executables

Posted by:

Dan O'Connor

code packer

packed code

tools

vmware

vmware malware detection

vulnerabilities

First I have to say that I dislike having to do this. My main problem is that if you are going to take the time to pack and attempt to protect your EXE, it's obvious that you are up to no good. For legitimate applications there is times when you would want to do this, but if it's some random...

August 15, 2012 7:33 PM

Julian Assange Update

Posted by: Dan O'Connor

Julian Assange, wikileaks

Ecuador says that the UK is threatening to enter it's embassy to arrest Mr.Assange. Ahead of the annoucmance on Thursday on if they will allow asylum. I don't know how much stranger this whole thing can get. http://www.bbc.co.uk/news/world-19259623

0 Comments

RSS Feed

Email a friend

August 15, 2012 7:28 PM

VMWare Malware Lab – Networking Edition

Posted by: Dan O'Connor

avoid virtual machine malware detection, virtual, vmware, vmware malware detection

When doing analysis I try to keep away from the infection machine, I keep my lab statically setup with an IP, and DNS, Gateway pointing at another machine. For a basic target all you need to do is have tcpdump running to capture any networking requests. If you want to get more complicated you can...

0 Comments

RSS Feed

Email a friend

August 15, 2012 1:17 AM

VMWare Malware Lab

Posted by: Dan O'Connor

virtual, virtualbox, vm, vmware

I am not going to cover the basic setup of a VMWare based lab, really you can use what ever you want as long as you can attempt to keep it isolated from the system. I use VMWare for a couple reasons, mainly for the ability for me to take vm's from fustion, workstation, ESXi and move them back...

0 Comments

RSS Feed

Email a friend