Skip to main content
Using Nepenthes

Hi, this manual is just covering the basic stuffs. Basically Nepenthes will catch malware faster if you put it in a place where the network is unfiltered.
Few things needed:
  • nepenthes
  • clam-av (so that you can scan the binaries)
  • hexeditor or khexeditor for KDE (if you want to go through the ASCII content)
  • and if "strings" command suit you, it'll give you easier read.

This snippet of output was taken from chatbox with snip3r (hehe)

$clamscan /var/lib/nepenthes/binaries/
/var/lib/nepenthes/binaries/malware_host_arp.pcap: OK
/var/lib/nepenthes/binaries/5b969ead104bf6afd187c4aad480ac45: OK
/var/lib/nepenthes/binaries/a9827363248ccc412911b1719d18183a: OK
/var/lib/nepenthes/binaries/94ee7b1bfa628bd990c5cbd522f3cf84: Trojan.Vanbot-41 FOUND
/var/lib/nepenthes/binaries/f948757c0ba0d2cd663f1e3988eb8787: Trojan.Mybot-7872 FOUND
/var/lib/nepenthes/binaries/7097c55ee0535457025dd158bb1988bb: Worm.Blaster.B FOUND


Well, in the " /var/lib/nepenthes/ " , it contains TWO other folders which are "hexdumps" (which in the SVN version is considered obsolete) and "binaries"
Labels:

Comments

Post a Comment

Popular posts from this blog

Gue dengan S2 gue. Sronok banget!
15 comments
Read more
Sed (streaming editor) big time mnajem @zalzalah ~ $ cat ustazasri.txt >Kuliah Dr. Mohd. Asri Zainul Abidin (Julai 2005) >>Tarikh >>Tempat >>Waktu >>Tajuk >>15 Julai 2005 JUMAAT >>Surau al-Muhajirun, Taman Sri Ukay, Ampang >>Selepas Maghrib >>Riyadh al-Salihin (Kitab Perkara yang Ditegah) >>16 Julai 2005 SABTU >>Balai Budaya Tun Syed Nasir, DBP Kuala Lumpur >>8.30 pagi ¿ 1.00 tgh >>DEBAT Astora Jabat vs Dr. Mohd. Asri ¿ Gerakan Tajdid: Satu Perbincangan >>17 Julai 2005 AHAD >>Dewan Kuliah, Balai Islam Masjid al-Ghufran, Pinggiran Taman Tun Dr. Ismail >>10.00 pagi >>Riyadh al-Salihin (Kitab Perkara yang Disuruh, Bab al-Taqwa, Bab ke-6) >>17 Julai 2005 AHAD >>Masjid Jamek Abdul Aziz, Jalan Templer, Petaling Jaya >>Selepas Maghrib >>Sahih al-Bukhariy (Kitab al-Iman) >>*Kuliah Maghrib di Masjid Al-Syakirin, Bandar Utama dibatalkan.> mnajem@zalzalah ~ $ sed -i...
Post a Comment
Read more
........speechless Salam, Aku lately mengalami masalah kesempitan wang yang serius disebabkan kereta satria aku yang berusia 10 tahun ada major repair.. dalam bulan ni je untuk kereta aku abis RM600 untuk maintenance. Ganti spectacle lagi. Accumulated maintaince expense untuk keta yang aku beli sejak Disember 2005 ni dekat RM3000 jugak. Ganti absorber,ganti tayar (haritu kan pancit-tayar last yang aku tak penah ganti pancit balik dari Kangar. Tayar tu tahun 2001. Owner lama tak tukar. Nasib la). Gaji macam aku ni dok seorang pun dah boleh jadi defisit, nak bayar PTPTN(auto deduct), loan laptop aku 2 tahun, then medical card(aku memikirkan sebab arwah abang aku dulu pernah kena kanser umur 29 tahun.. dan kebetulan dia ambik insurans tu tak jauh tarikh dari dia kena sakit tu, kampeni insurans tak nak bayar sebab assume dia dah tau sakit baru ambik polisi. Nak buat macam mana. So sewaktu sihat la fikir nak ambil polisi gini). Memang ada medical benefit, tapi kita tak tau future jadi apa, ...
8 comments
Read more