poison ivy Archives - The Volatility Foundation - Promoting Accessible Memory Analysis Tools Within the Memory Forensics Community

What do Upclicker, Poison Ivy, Cuckoo, and Volatility Have in Common?

by Volatility | Dec 21, 2012 | code injection, forensics, malware, poison ivy, volatility, windows

Earlier this month, FireEye researchers Abhishek Singh and Yasir Khalid introduced Trojan Upclicker – malware that detects automated sandboxes by hooking mouse movements. If these user interactions never occur, the malware stays dormant, but as soon as someone...

Reverse Engineering Poison Ivy’s Injected Code Fragments

by Volatility | Oct 16, 2012 | code injection, distorm, forensics, grrcon, malware, poison ivy, volatility, windows

This is an addendum to GrrCon Network Forensics Challenge with Volatility. In the initial post we covered the basics – the what, the when, and the how. We found strings in memory, such as the mutex name, the registry Run key, and the svchosts.exe file name; then...