VB2020 paper: Lightweight emulation based IOC extraction for Gafgyt botnets
Excerpt
Ya Liu
Qihoo 360 Technology, China
liuya@360.cn
30 September - 2 October, 2020 / vblocalhost.com
www.virusbulletin.com
LIGHTWEIGHT EMULATION BASED IOC EXTRACTION FOR GAFGYT BOTNETS LIU
2 VIRUS BULLETIN CONFERENCE SEPT - OCT 2020
ABSTRACT
The long-established botnet family of Gafgyt is still very active today. While new C2 servers emerge quickly, they usually remain active for only a few days. To effectively fight such quickly emerging while short-lived families, quick IoC extraction is import. In this paper I will introduce how to extract IoCs for Gafgyt by exploiting its characteristic C2 loop and by lightweight emulating its initConne…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by vb2020.vblocalhost.com on vb2020.vblocalhost.com.
On the same topics
- Silent Push Identifies More Than 10,000 Infected IPs as Part of SystemBC Botnet Malware FamilySilent Push · Published 4 Feb
- The DGA of Sisronbin.re · Added 25 Oct
- JDY Botnet: How IoT and SOHO Devices Are ExploitedLumen Black Lotus Labs · Added 10 Oct
