Daniel Plohmann daniel.plohmann@fkie.fraunhofer.de @push_pnx @malpedia

More documents

Recommendations

Info

The Malware Knowledge Archipelago A typical situation • Your [spam protection, HTTP proxy, HIPS, …] intercepts a potential malware sample. • Eventually, you re-upload the now unpacked sample to VirusTotal: Aha! Aha! TrickBot! [1] https://www.virustotal.com/en/file/6356ed6ca05c8f87f1ae34aa1f3c4a119c5b6e811b00cb996ba688cc6695f683/analysis/ 12 © Cyber Analysis and Defense Department, Fraunhofer FKIE
The Malware Knowledge Archipelago A typical situation • Your [spam protection, HTTP proxy, HIPS, …] intercepts a potential malware sample. • You google it and happyness ensues: [1] https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/ 13 © Cyber Analysis and Defense Department, Fraunhofer FKIE
Page 1 and 2: Daniel Plohmann daniel.plohmann@fki
Page 3 and 4: The Malware Knowledge Archipelago 3
Page 5 and 6: The Malware Knowledge Archipelago A
Page 11: The Malware Knowledge Archipelago A
Page 15 and 16: Other Efforts to Systematize 15 ©
Page 17 and 18: The Malware Knowledge Archipelago O
Page 25 and 26: The Malware Knowledge Archipelago T
Page 27 and 28: Malpedia The central concept • Go
Page 29 and 30: Malpedia The Vision • Goals: •
Page 31 and 32: Malpedia: Status Quo Progress • D
Page 33 and 34: Malpedia: Status Quo Data acquistio
Page 35 and 36: Malpedia: Status Quo /home/analyst/
Page 37 and 38: Malpedia: Status Quo Web UI 37 © C
Page 39 and 40: Malpedia: Status Quo Web UI 39 © C
Page 41 and 42: Malpedia: Status Quo Web UI [1] htt
Page 47 and 48: What’s already possible Status Qu
Page 51 and 52: Malpedia: Status Quo YaraRules.com
Page 55 and 56: Malpedia: Status Quo file vs. Malpe
Page 57 and 58: Malpedia: Status Quo Disassembler v
Page 63 and 64:
Roadmap Ingredients for Future Good
Page 65 and 66:
Roadmap Gabby: A Malware Classifica
Page 67 and 68:
Conclusion 67 © Cyber Analysis and
Page 69:
Thank You for Your Attention! Danie
show all

Daniel Plohmann daniel.plohmann@fkie.fraunhofer.de @push_pnx @malpedia

Create successful ePaper yourself

Delete template?

Save as template?