Monthly Archives: September 2011

Volatility Memory Forensics | DumpIt

Before you can conduct victim system analysis you need to capture memory. MoonSols DumpIt is used to generate a physical memory dump of Windows machines. It works with both x86 (32-bits) and x64 (64-bits) machines. Only a double click on … Continue reading

Posted in English, Malware Forensics, Memory Forensics, Volatility | Leave a comment

Volatility Memory Forensics | Basic Usage for Malware Analysis

Here is a real-world example of using Volatilty and YARA. You can download this good old ZeuS image from the Malware Analyst’s Cookbook: zeus.vmem.zip [41,4 MB] 1.) Go into your Volatility directory 2.) If you don’t know what type of … Continue reading

Posted in Banking Trojan, English, Malware Forensics, Memory Forensics, Volatility | 3 Comments

Volatility Memory Forensics | Installation in Ubuntu

Requirements: A Windows, Linux, or Mac OS X machine Python version 2.6 or greater, but not 3.x (already installed on Ubuntu) Supported Samples 32bit Windows XP Service Pack 2 and 3 32bit Windows 2003 Server Service Pack 0, 1, 2 … Continue reading

Posted in English, Malware Forensics, Memory Forensics, Volatility | Leave a comment