Function Identification and Recovery Signature Tool Botconf 2016 Thursday | 12:20 – 12:50 Angel Villegas 🗣 Reverse Engineering benign or malicious samples can take a considerable amount of time and new samples are created daily. Leveraging disassemblers, like IDA Pro, a reverse engineer can analyze the same routines across several samples over the lifetime of […]
Function Identification and Recovery Signature Tool Read More »
Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Botconf 2016 Thursday | 14:00 – 14:35 Tom Ueltschi 🗣 Enterprises and organizations of all sizes are struggling to prevent and detect all malware attacks and advanced adversary actions inside their networks in a timely manner. Prevention focused technology hasn’t been good enough to prevent
Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Read More »
How Does Dridex Hide Friends? Botconf 2016 Thursday | 14:40 – 15:00 Paul Rascagnères 🗣 | Sébastien Larinier 🗣 | Alexandra Toussaint 🗣 During an incident, CERT Sekoia investigated fraudulent money transfers. These transfers were made from a French firm account to other bank accounts based in different places in Europe. The fraud has been valued at 800 000
How Does Dridex Hide Friends? Read More »
A Tete-a-Tete with RSA Bots Botconf 2016 Thursday | 15:05 – 15:35 Jens Frieß 🗣 | Laura Guevara 🗣 The expansion and specifically the sophistication of botnets has brought with it an increased use of cryptography for safe-guarding communication channels between bots and their command-and-control instances. Asymmetric encryption (or public-key cryptography) currently poses a major challenge for
A Tete-a-Tete with RSA Bots Read More »
FastIR Collector Botconf 2016 Tuesday | 10:30 – 12:30 Sébastien Larinier 🗣 The goal of the wokshop is to present and use the open source live forensic collector FastIR on differents cases investigations on Windows: RAT with tricks anti forensics, rootkits, Trojan with dll injections… And we’ll present new features we have developped this year
Cracking Banking Fraud Botconf 2016 Tuesday | 14:00 – 17:30 Pavel Asinovsky 🗣 | Magal Baz 🗣 This workshop takes us into the world of banking malware, and more specifically into researchers’ chase after configurations – the attack books that dictate which banks are targeted and how. These precious ever-changing fragments of data and the continuous change
Cracking Banking Fraud Read More »
MISP, the Threat Sharing Platform, a Developer Perspective to Extensions and Collaboration Botconf 2016 Tuesday | 14:00 – 17:30 Alexandre Dulaunoy 🗣 | Andras Iklody 🗣 MISP is becoming a key open source package for indicator and threat sharing in the information security community. MISP improved its modularity in the recent versions and propose various ways to
Getting Your Hands Dirty: How to Analyze the Behavior of Malware Traffic and Web Connections Botconf 2016 Tuesday | 14:00 – 17:30 Veronica Valeros 🗣 | Sebastián García 🗣 Nowadays there are a lot of tools to analyze traffic, but the most important thing to have is the experience and knowledge of a malware analyst. The goal
Locky, Dridex, Necurs: the evil triad Botconf 2016 Wednesday | 11:20 – 12:00 Jean-Michel Picod 🗣 While Locky and Dridex inner working are well understood as they have been on the news all year long, how their distribution system operate is still relatively unknown as it is only seen by email providers.In this talk we
Locky, Dridex, Necurs: the evil triad Read More »
Visiting the Bear’s Den Botconf 2016 Wednesday | 12:05 – 12:55 Jessy Campos 🗣 | Joan Calvet 🗣 Sednit, a.k.a. Fancy Bear/APT28/Sofacy, is a group of attackers operating since at least 2004 and whose main objective is to steal confidential information from specific targets. Over the past two years, this group’s activity increased significantly, in particular with
Visiting the Bear’s Den Read More »