4 ms·
Great summary, these types of articles always make me want to learn more about capturing malware. Could you use something like Yara to then write your own rules
by cdnsteve 12y ago
Great summary, these types of articles always make me want to learn more about capturing malware. Could you use something like Yara to then write your own ruleset to identify this?
- moyix 12y agoYep; indeed, Volatility itself has a plugin called `yarascan` that will tell you about any hits on Yara signatures inside of a memory image. https://code.google.com/p/volatility/wiki/CommandReferenceMal23#yarascan https://code.google.com/p/volatility/wiki/CommandReferenceMa... Edit: Also, this approach is basically how the Detekt [1] tool works -- it loads Volatility and scans process memory using its own set of Yara rules. [1] https://resistsurveillance.org/ https://resistsurveillance.org/