Skip to main content
Using Nepenthes

Hi, this manual is just covering the basic stuffs. Basically Nepenthes will catch malware faster if you put it in a place where the network is unfiltered.
Few things needed:
  • nepenthes
  • clam-av (so that you can scan the binaries)
  • hexeditor or khexeditor for KDE (if you want to go through the ASCII content)
  • and if "strings" command suit you, it'll give you easier read.

This snippet of output was taken from chatbox with snip3r (hehe)

$clamscan /var/lib/nepenthes/binaries/
/var/lib/nepenthes/binaries/malware_host_arp.pcap: OK
/var/lib/nepenthes/binaries/5b969ead104bf6afd187c4aad480ac45: OK
/var/lib/nepenthes/binaries/a9827363248ccc412911b1719d18183a: OK
/var/lib/nepenthes/binaries/94ee7b1bfa628bd990c5cbd522f3cf84: Trojan.Vanbot-41 FOUND
/var/lib/nepenthes/binaries/f948757c0ba0d2cd663f1e3988eb8787: Trojan.Mybot-7872 FOUND
/var/lib/nepenthes/binaries/7097c55ee0535457025dd158bb1988bb: Worm.Blaster.B FOUND


Well, in the " /var/lib/nepenthes/ " , it contains TWO other folders which are "hexdumps" (which in the SVN version is considered obsolete) and "binaries"

Comments

Popular posts from this blog

Danga Bay, Chevrolet Optra and bio...(eh?) I thought it was Debian(haha). My colleague point me to the AirAsia flight turbin and he told me, "Macam debian punya logo" I saw a spiral on top the turbin blades. Pretty much like Debian Logo That's spark me to shoot for a pix. And I was warned by the airport staff. Uh,uh. Flash lamp will spark burst,eh? I was presented my "mock" research proposal. Suggested "Profiling Bioinformatics Application Behavior on Distributed Computing Architecture". Eh, will this gonna be bioinformatics specific or hardware optimization specific.or? Flashback: I spent almost a week at the office. When it's Subh azan,went back to my house for bath and pray. Reading all the journals and papers was not funny,really. Tough eye balls. No world cup. Ewh. And have some VCD lure. Uh,uh. you gonna be kidding. Anyway, I learned a lot and UTM SLAB Research Course is no joke. Really. My proposal has been corrected with comments so I have
Gue dengan S2 gue. Sronok banget!