What's new Search

Recent content by gandolf

G
BlackEnergy 2 (alias BlackEnergy Version 2) Live Debugging

You're right, although this problem has also spawned some tools meant to emulate such network connectivity. One that comes to mind is FakeNet (FakeNet | Running the Gauntlet), written by the authors of an amazing book called practical malware analysis. There are plenty other tools such as...
- gandolf
- Post #8
- Nov 4, 2014
- Forum: BSOD Kernel Dump Analysis Debugging Information
G
Rustock.B Live Debugging

It's worth mentioning that a fella by the name of Dennis had released a rather complete book on reverse engineering for free. You can find it here: https://github.com/dennis714/RE-for-beginners I had an opportunity to read an early draft of this and I think its a rather noble gesture and is...
- gandolf
- Post #5
- Nov 3, 2014
- Forum: Bugchecks + Parameters + Windbg Commands (Public)
G
BlackEnergy 2 (alias BlackEnergy Version 2) Live Debugging

Yara is a great tool for malware identification and classification. I use it quite often in my work. Also, for Patrick, great article, I have a question for you, do you perform these operations on the infected machine (VM) itself, or run a remote kernel debugging session to the virtual Machine...
- gandolf
- Post #4
- Nov 3, 2014
- Forum: BSOD Kernel Dump Analysis Debugging Information
G
Hello from the US of A :)

Hi Jared, it looks to be one of your very own members, Patrick. In particular this post on rustock, after chasing more information about the WinDBG extension SwishDBGExt. Debugging and reverse engineering: Rustock.B Live Debugging - SwishDbgExt, SysecLabs script. regards,
- gandolf
- Post #6
- Nov 3, 2014
- Forum: Introductions - New Members
G
Hello from the US of A :)

Your translation is mostly accurate Patrick! However, I also stare at them in my subconscious, which equates to 24 out of 24 hours hah!...I need to escape
- gandolf
- Post #3
- Nov 3, 2014
- Forum: Introductions - New Members
G
Hello from the US of A :)

Hi all, Just happened to stumble on this forum from a blog post. Great place here and I hope to learn and share as much as I can. I am a Malware Analyst by profession and hope to expand my skill set from the resources here and lend my expertise where I can. Thank you regards, gandy
- gandolf
- Thread
- Nov 3, 2014
- Replies: 9
- Forum: Introductions - New Members

gandolf

Recent content by gandolf

BlackEnergy 2 (alias BlackEnergy Version 2) Live Debugging

Rustock.B Live Debugging

BlackEnergy 2 (alias BlackEnergy Version 2) Live Debugging

Hello from the US of A :)

Hello from the US of A :)

Hello from the US of A :)