Honeypots
Call For Papers - hack.lu 2010 - 27-29 October - Luxembourg Apr 04 2010 04:50PM
Alexandre Dulaunoy (adulau gmail com) (1 replies)
info reg Zeus bot detection and analysis May 19 2010 11:12AM
Mayank.2.Bhatnagar (MBhatnagar ipolicynetworks com) (1 replies)
Hi everyone,

We are able to collect several samples of Zeus bot and there are many variants of the same.
However when we try to analyse it in our sandbox and closed environment, we are not able to get any activity.
There are several reports available, which are for same md5sum sample but still after much of analysis and triggering attempts, either the malicious sample dosnt trigger or if it does, it doesn't show any network activity.

What could be the reason? Where is the catch?? We have referred Zeus tracker sites (https://zeustracker.abuse.ch/blocklist.php), threatExpert reports but precisely what kind of analysis should be done and what environment created to analyse these setups.

We found that Vmware/Virtual setups may have been getting detected, but what abt a live sandbox environment. Why is the malicious exe not triggering there?? Where are we missing?

Anyone having pointers, suggestions...please suggest.
Thanks a lot,

Regards,
Mayank,
India

[ reply ]
RE: info reg Zeus bot detection and analysis May 19 2010 03:39PM
Michele Zoerb (mzoerb the41 com) (1 replies)
RE: info reg Zeus bot detection and analysis May 19 2010 08:06PM
Younger Tyler (Tyler Younger ssfhs org)


 

Privacy Statement
Copyright 2010, SecurityFocus