CyberGuerrilla soApboX » #ro0ted #OpNewblood What the blackhats dont want you to know: Analyzing the ZeuS bot Part 2

CyberGuerrilla soApboX » #ro0ted #OpNewblood What the blackhats dont want you to know: Analyzing the ZeuS bot Part 2 

Okay start up REMnux and sign in as root.

We start with the command like in the previous tutorial:

type: volatility -f ‘zeus.vmem’ imageinfo

Anti-Botnet Advisory Centre: Inform

Anti-Botnet Advisory Centre: Inform  

To prevent the re-infection of your computer please note these important rules:

• 
  
  1
  
  Check your computer for infection. Please use our EU-Cleaner to remove all
  malware.
  
• 
  
  2
  
  Install current Service Packs and Security Updates for your system. Activate automatic updates. Microsoft Instructions: Protect.
  
• 
  
  3
  
  Check your Internet browser and the
  embedded plugins (e.g. Java, Flash, Shockwave, Quicktime) regularly to
  make sure they are up to date. Browser- and Plugincheck
  
• 
  
  4
  
  Install a virus scanner, e.g. one that is mentioned here and update it
  regularly.
  
• 
  
  5
  
  Use a firewall e.g. built-in Windows firewall or a router. More Information
  about Firewalls..
  

hfiref0x/UACME · GitHub

hfiref0x/UACME · GitHub

UACMe

• Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor.
• More info http://www.kernelmode.info/forum/viewtopic.php?f=11&t=3643
  

Blaze's Security Blog: Thoughts on Absolute Computrace

Blaze's Security Blog: Thoughts on Absolute Computrace: Introduction Not too long ago my friend and colleague from Sweden, Jimmy, contacted me in regards to a strange issue. In the firewall, he...

TorrentLocker changes it's name to Crypt0L0cker and bypasses U.S. computers - News

TorrentLocker changes it's name to Crypt0L0cker and bypasses U.S. computers - News   



A new ransomware called Crypt0L0cker (the OHs have been replaced with
ZEROs) has been released that appears to be a new version of TorrentLocker.
This ransomware was first sighted at the end of April in European and
Asian countries and in Australia. Unlike TorrentLocker, for some reason
this variant is Geo-Locked so that it will not install on US based
computers. This ransomware is currently being distributed through emails
that pretend to be traffic violations or other government notices. At
this point it is unknown what encryption method is used and if its
possible to recover encrypted files. The ransom amount is currently set
for 2.2 Bitcoins.