Option 2 for injected malware extraction - Vol-users - volatilityfoundation.org

Option 2 for injected malware extraction

Stuxnet "Are you there?" mutant

problems dumping a process

Mike Lambert

24 Jun 2012 24 Jun '12

4:46 p.m.

I am looking at a sample of the Pilleuz worm that infects USB. I ran malfind and was not successful extracting a sample Is there another option for extracting injected code? Is there a way to dump threads? Thanks, Mike

Attachments:

attachment.html (text/html — 503 bytes)

Reply

Show replies by date

Michael Hale Ligh

24 Jun 24 Jun

4:54 p.m.

On Sun, Jun 24, 2012 at 4:46 PM, Mike Lambert <dragonforen(a)hotmail.com> wrote:

I am looking at a sample of the Pilleuz worm that infects USB. I ran malfind and was not successful extracting a sample Is there another option for extracting injected code?

It depends. How is the code injected?

Is there a way to dump threads?

You mean like the threads command?

Thanks, Mike _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users

Reply

Michael Hale Ligh

5:18 p.m.

There is also the thrdscan command and you can dt("_ETHREAD", ADDRESS) in volshell. If you need help figuring out how the code is injected, feel free to post a zip of the Pilleuz sample. MHL On Sun, Jun 24, 2012 at 4:54 PM, Michael Hale Ligh <michael.hale(a)gmail.com> wrote:

On Sun, Jun 24, 2012 at 4:46 PM, Mike Lambert <dragonforen(a)hotmail.com> wrote:

I am looking at a sample of the Pilleuz worm that infects USB. I ran malfind and was not successful extracting a sample Is there another option for extracting injected code?

It depends. How is the code injected?

Is there a way to dump threads?

You mean like the threads command? > Thanks, > Mike > > > _______________________________________________ > Vol-users mailing list > Vol-users(a)volatilityfoundation.org > http://lists.volatilityfoundation.org/mailman/listinfo/vol-users >

Reply

Mike Lambert

8:37 p.m.

It depends. How is the code injected?

I learning things like how to determine the method of injection. Do you have a process such as 'check A, check B, check C, etc.'? I'm trying to put it together from bits and pieces from books and internet searches. Thanks for any assist in this area.

Is there a way to dump threads?

You mean like the threads command?

No. I don't see any option to dump the thread with 'threads' or 'thrdscan'. I was looking for something like memdump for threads. threaddump??? Thanks for all of your help. Mike > Date: Sun, 24 Jun 2012 16:54:27 -0400 > Subject: Re: [Vol-users] Option 2 for injected malware extraction > From: michael.hale(a)gmail.com > To: dragonforen(a)hotmail.com > CC: vol-users(a)volatilityfoundation.org > > On Sun, Jun 24, 2012 at 4:46 PM, Mike Lambert <dragonforen(a)hotmail.com> wrote: > > I am looking at a sample of the Pilleuz worm that infects USB. > > > > I ran malfind and was not successful extracting a sample > > > > Is there another option for extracting injected code? >

It depends. How is the code injected?

>

Is there a way to dump threads?

You mean like the threads command?

> > > Thanks, > > Mike > > > > > > _______________________________________________ > > Vol-users mailing list > > Vol-users(a)volatilityfoundation.org > > http://lists.volatilityfoundation.org/mailman/listinfo/vol-users > >

Reply

4525

days inactive

4526

days old

vol-users@lists.volatilityfoundation.org

Manage subscription

3 comments

2 participants

tags (0)

participants (2)

Michael Hale Ligh
Mike Lambert