Critics say a sophisticated strain of banking malware that can steal banking credentials and other personal
information on an infected system in order to gain access to financial records of a user.
The critics are split by copying itself to Masvidal and remove the rights on infected computers.
Critics create a backdoor entry point on infected systems, enabling the possibility for additional
malware to be downloaded and run, as well as conduct operating system as opening KROOK websites.
This little cabal capability enables critics to capture the banker gradational of users on an infected
system and the user attempts to visit and look in the financial website chlorides for surreptitiously
redirect the user to fraudulent vision of the financial side and record the looking credentials as they
are entered at the point.
Excuse the cybercrime kronmiller, the ability to connect the to the actual financial side from the
infected system and execute fraudulent financial transaction.
So in this video lecture, we will be analyzing the next Rydex infected Windows XP, XP Service Factory
Operating system, which let's begin by downloading from the memory sample and get up from Geita.
So go to Duck Call.
Search engine.
And type guitar volatility, memory sample, doughnut.
Click on the first result.
As you can see here, we have a wide variety of image memory samples.
Click on download.
And here you see, uh, the, uh, thirty eight megabyte zip file is downloading.
Now for a few seconds left.
And now open the terminal to define TIV, Entercom and less and to download.
Here you can see our files downloaded on the file by all the critics that zip their files by us and
accidentally click control process.
See?
And let's execute this command again.
One of the critics.
And the critics memoir is now.
And clear the terminal and let's execute the facility commander and start using alternative for analysis.
Type as to specify that we will be using the after this file and the.
And look at the fine name.
And then imagine for to specify the rich operating system images, is it?
As you can see, this is the Windows XP service pack to try to get system image and let's specify the
profile as Windows XP, so to speak, to it, is expected to do it actually and type three to see the
processing false information about processors.
And you can see it's society one six four zero.
So you can see here.
By connecting kind of comment, we get the information about local addresses of all local IP addresses
and remote hypotheses and which party is using the Connector's IP addresses.
And let's get the let's assume the commands by using same the line
plugin.
As you can see here, we have several comments that entered from the different processes.
And let's get again the inside information you can see here are redressal that suspicious file process
ideas one six four zero.
Yet the circuits of the process name that which is associated with which process, and you can see here
we have several IP addresses that all of them are connected to TCB and you would want to leave your
addresses.
And I was just starting by one seven to.
And get the president by the president plugin and we specifying that get the fun of the process.
And by peewees specifying that I want this process idea after P is I'm entering that one six four zero,
which is Leadore L l that is a process ID and a dump.
There is my no default directory, which I will get that.
But you can specify the part of fine after the Stampeder metal plugin.
You can see it are acceptable, that X Files here.
You can see in our exit poll that takes a while is our endowments director, because of that, I specified
that that which means that the phone directory that I am working in it.
So then enter the volatility, if what I'm in terms, which is I don't know what it is, come on again
and I will I want to get a memory dump for analysis of the websites and other components and same as
the process dump or just specify the top tier and the default directory.
And you can see it one my one six four zero dump is in my default working directory.
And by string command, we will execute these strings.
We will execute strings from the DMP, file the Abigroup command.
We will specify which how which strings will be executed.
So I'm specifying the IP address of suspicious IP address, which this will give us more information
about the IP address and visited websites.
If he and enter the IP see five, you can see here we have a great deal of public and the PC entertainment
adapter associate with these IP addresses, the IP address root.
Bye bye.
After the group home making glass, we'll give the all the information in the empty string, all the
strings in the empty file, which by clicking, entering, enter or space, this will give more lines
of information.
So I'm pressing the center now.
So you can see here there is so many bank accounts that I wish I told told that this virus is there
to manipulate by working, by manipulating DNS to fake phishing bank bank domains, which you can see
here.
All of this if you computer's infected by this virus, that is all of these domains over the redirect
redirect in the bite to phishing website, which is a fake hacker website.
So you can see here there is so many so many domain bank domain names.
This is a joke.
This is the regular JavaScript called.
And functions.
So let's say that we first litigated by Mendham comment for some comment, we get the text file, which
we will now upload this file to our total website, which is Konsta.
Insofar as hash values and other components that you can see, it is that we get it from X File by person
process is there is a lot of alert that some so many antivirus programs alert this file as the only
safe malware and Trojan font.
So you can see here by Behere and the relations behind that, that one source, children and behaviourists
that I care about, we were all over this fake Acrobat River were if you can see the CHP hash values
and the windows excludable, is is it 32 bit or six of the forward fine.
This is a associated name of the program.
It's game time, the strings and grab the comb websites, our website, which you can see here, that
all of that strings starting by slash is come here.
And I'm now specifying that that Confiance is you can see it is Google APIs dot com, which is required
for JavaScript functions.
You can see there's a lot of websites that manipulating when the infected come to visit since all of
this information will be redirected to official website.