Malware Tools

Here are links to the tools that I talked about. Thanks to everyone who came and thanks to Bluelock once again for hosting.

Reverse Engineering Malware Cheat Sheet
http://www.zeltser.com/reverse-malware/reverse-malware-cheat-sheet.html

Ollydbg
http://www.ollydbg.de/

Ollydump to find OEP and dump process from memory
http://www.openrce.org/downloads/details/108/OllyDump

Hide from IsDebuggerPresent in Ollydbg:
http://www.openrce.org/downloads/details/111/IsDebuggerPresent

upx
http://upx.sourceforge.net/

un_fsg
http://programmerstools.org/node/208

PEiD
http://www.peid.info/

PEiD plug-ins
http://www.peid.info/BobSoft/Plugins.html

Volatility
https://www.volatilesystems.com/default/volatility

Volatility plug-ins
http://www.forensicswiki.org/wiki/List_of_Volatility_Plugins

Mantech Memory Dump
http://sourceforge.net/project/showfiles.php?group_id=228865

HB Gary Fast Dump
http://www.hbgary.com/products-services/fastdump-pro/

March IndySec

March IndySec time!

Brian Carter will be presenting "Unpacking Malware, tools and techniques for analyzing encrypted and compressed malicious binaries."

The March IndySec will be hosted at the Bluelock data center. The facility is topnotch and includes a training area --- perfect for our event.

Date 3/18 (Wednesday, not the usual Thursday)
Time 6:30 PM
Location 6325 Morenci Tr. Indianapolis, IN 46268 Google map here.
Food We will order pizza after everyone arrives.

We have a great speaker at a great location - see you there.

-Steve

March IndySec Firetalks

March 19th is the next IndySec! 

For March, we would like to do a series of quick "fire talks" at the next IndySec. The idea has been adapted from the 09 podcasters meetup at Shmoocon. Information, credit, and proper description here.



What is a Firetalk?

“FireTalks” is a supportive environment in which to either share insights or learn from others. Whether polishing a presentation (story) for conferences, meetings or training, firetalks are the way to share, learn and improve.

Talks are generally 10-15 minutes. Anyone may submit a talk. If you need help or have questions, please email me at this address :



Also, the February IndySec had around 15 people in attendance. Thanks for the great turnout!  

March will be our 27th IndySec. 

Cheers,
Steve

IndySec (2/19)

IndySec,

We are back at the Claddagh this month (hey, we have $40 to spend in gift cards).

Ask the greeter for the IndySec table. Things will start around 6pm. Please comment to the blog if you plan to attend.

items to discuss
1. Shmoocon recap
2. i am developing a "Practical Security" presentation/class and would like some feedback

Claddagh Irish Pub
3835 E 96th St
Indianapolis, IN 46240

Cheers,
Steve

IndySec next week -- 2/19

IndySec,

In January, team IndySec brought home dinner plate gold at the Claddaugh international games (really just a trivia contest). First prize was $40 in Claddaugh bucks (easily converted to beer). Upon victory, Ed and Brian did a chest bump which was later followed by an extra long man hug.

Question to the list: We have the spoils, do we defend the crown and spend the booty!?

(so, do you want to meet back at the Claddaugh pub @ 96th / Keystone?)  If no, then maybe our next speaker will get the $40 gift card?! 

Shmoocon rocked. See you Thursday, 2/19.

Let me know. Thanks!
Steve