How Does Dridex Hide Friends? Botconf 2016 Thursday | 14:40 – 15:00 Paul Rascagnères 🗣 | Sébastien Larinier 🗣 | Alexandra Toussaint 🗣 During an incident, CERT Sekoia investigated fraudulent money transfers. These transfers were made from a French firm account to other bank accounts based in different places in Europe. The fraud has been valued at 800 000 […]
How Does Dridex Hide Friends? Read More »
A Tete-a-Tete with RSA Bots Botconf 2016 Thursday | 15:05 – 15:35 Jens Frieß 🗣 | Laura Guevara 🗣 The expansion and specifically the sophistication of botnets has brought with it an increased use of cryptography for safe-guarding communication channels between bots and their command-and-control instances. Asymmetric encryption (or public-key cryptography) currently poses a major challenge for
A Tete-a-Tete with RSA Bots Read More »
FastIR Collector Botconf 2016 Tuesday | 10:30 – 12:30 Sébastien Larinier 🗣 The goal of the wokshop is to present and use the open source live forensic collector FastIR on differents cases investigations on Windows: RAT with tricks anti forensics, rootkits, Trojan with dll injections… And we’ll present new features we have developped this year
Cracking Banking Fraud Botconf 2016 Tuesday | 14:00 – 17:30 Pavel Asinovsky 🗣 | Magal Baz 🗣 This workshop takes us into the world of banking malware, and more specifically into researchers’ chase after configurations – the attack books that dictate which banks are targeted and how. These precious ever-changing fragments of data and the continuous change
Cracking Banking Fraud Read More »
MISP, the Threat Sharing Platform, a Developer Perspective to Extensions and Collaboration Botconf 2016 Tuesday | 14:00 – 17:30 Alexandre Dulaunoy 🗣 | Andras Iklody 🗣 MISP is becoming a key open source package for indicator and threat sharing in the information security community. MISP improved its modularity in the recent versions and propose various ways to
Getting Your Hands Dirty: How to Analyze the Behavior of Malware Traffic and Web Connections Botconf 2016 Tuesday | 14:00 – 17:30 Veronica Valeros 🗣 | Sebastián García 🗣 Nowadays there are a lot of tools to analyze traffic, but the most important thing to have is the experience and knowledge of a malware analyst. The goal
Locky, Dridex, Necurs: the evil triad Botconf 2016 Wednesday | 11:20 – 12:00 Jean-Michel Picod 🗣 While Locky and Dridex inner working are well understood as they have been on the news all year long, how their distribution system operate is still relatively unknown as it is only seen by email providers.In this talk we
Locky, Dridex, Necurs: the evil triad Read More »
Visiting the Bear’s Den Botconf 2016 Wednesday | 12:05 – 12:55 Jessy Campos 🗣 | Joan Calvet 🗣 Sednit, a.k.a. Fancy Bear/APT28/Sofacy, is a group of attackers operating since at least 2004 and whose main objective is to steal confidential information from specific targets. Over the past two years, this group’s activity increased significantly, in particular with
Visiting the Bear’s Den Read More »
LURK – The Story about Five Years of Activity Botconf 2016 Wednesday | 14:00 – 14:30 Vladimir Kropotov 🗣 | Fyodor Yarochkin 🗣 Lurk activity was solely in Russia slince late 2011, but the technologies they use became noisy, when it appeared in the “World Market” years later. We were able to track activity despite the low
LURK – The Story about Five Years of Activity Read More »
Browser-based Malware: Evolution and Prevention Botconf 2016 Wednesday | 14:35 – 15:05 Andrey Kovalev 🗣 | Evgeny Sidorov 🗣 Nowadays web technologies allow users to make a lot of their work online. Cloud services, social networks, online games etc. are gaining more and more popularity and are replaicing desktop applications and offline stuff. Web-browsers also offer special
Browser-based Malware: Evolution and Prevention Read More »