Part2.2 :Malware Analysis :Malware Sources

The following are some of the sources from where you can get

https://www.hybrid-analysis.com/

https://beta.virusbay.io/

https://contagiodump.blogspot.com/

https://virusshare.com/

https://thezoo.morirt.com/

https://malwr.com/

Comments

Part 1.3 :Disk Analysis, Autopsy & Redline

Disk Analysis, Autopsy & Redline Autopsy: Autopsy gives you the option to acquire data from both live systems or from a disk image. After adding your data source, navigate to the location of the files you want to extract, then right-click and select the Extract File(s) option. It will look similar to what you see in the screenshot below How to start Digital forensics Investigations with Autopsy 1. Download Autopsy 2. Download Hxd 3. Download md5sum 4. Download dd.exe 5. Create disk image using dd.exe PS C:\Users\ME\Desktop\Tool\tools source> .\dd.exe if=\\.\e: of=c:\users\me\desktop\cases\image.dd bs=1M –-progress 6. Create hash for image using md5sum or hasher PS C:\Users\ME\Desktop\Tool\tools source> .\md5sums.exe c:\users\me\desktop\cases\image2.dd ...

Chain of Custody – Digital Forensics

Chain of Custody – Digital Forensics Chain of Custody refers to the logical sequence that records the sequence of custody, control, transfer, analysis and disposition of physical or electronic evidence in legal cases. Each step in the chain is essential as if broke, the evidence may be rendered inadmissible. Thus we can say that preserving the chain of custody is about following the correct and consistent procedure and hence ensuring the quality of evidence. The chain of custody in digital cyber forensics is also known as the paper trail or forensic link, or chronological documentation of the evidence. · Chain of custody indicates the collection, sequence of control, transfer and analysis. · It also documents details of each person who handled the evidence, date and time it was collected or transferred, and the purpose of the transfer. · It de...

Part 1.2: Memory Analysis

Part 1.2: Memory Analysis Investigating Malware Using Memory Forensics Memory forensics is a technique used in digital forensics that involves the analysis of a computer's volatile memory (RAM) to obtain information about running processes, open network connections, system configurations, and other valuable data. This technique is particularly useful in investigating malware, as malware often tries to hide its presence on a system, making it difficult to detect using traditional methods. When investigating malware using memory forensics, there are several steps to follow: 1. Acquisition: The first step is to acquire the volatile memory from the infected system. This can be done using tools such as FTK Imager or Volatility. 2. Analysis: Once the memory has been acquired, it is time to analyze it. This involves examining the memory for suspicious processes, network connections, and other indicato...

Cybersecurity - Digital Forensics

Search This Blog