Re: OffensiveComputing

[Thorsten Holz <thorsten.holz () mmweg rwth-aachen de>]

Dave Aitel wrote:
> Another option is to run them in a sandbox, and just record their use
> of API's as a vector.

http://www-pi1.informatik.uni-mannheim.de/diplomas/show/45

The result of this thesis should be able to build such a signature. In
addition, it can hopefully also extract the information about a botnet
from a given binary, similar to what Norman's Sandbox can do now
[http://sandbox.norman.no/live_2.html?logfile=446750]

> Just some ideas. It's great to see a public collection of this stuff 
> finally, because research is very hard to do without it.

At our lab, we are currently building a similar database:
http://www-pi1.informatik.uni-mannheim.de/projects/malware

Unfortunately, most things are currently br0ken since we move to another
server :-/ The nepenthes site has some more information:
http://nepenthes.sourceforge.net/stats and in the near future (TM) we
will hopefully have a central server to which everything can submit his
binaries.

Cheers,
  Thorsten