volatilityの作法 その17

#概要

volatilityの作法、調べてみた。
malconfscanやってみた。

#volatility malconfscan -f zeus.vmem/zeus.vmem 

```
Volatility Foundation Volatility Framework 2.6
[+] Searching memory by Yara rules.
```

#volatility malconfscan -f stuxnet.vmem/stuxnet.vmem 

```
Volatility Foundation Volatility Framework 2.6
[+] Searching memory by Yara rules.
```

#volatility malconfscan -f laqma.vmem/laqma.vmem 

```
Volatility Foundation Volatility Framework 2.6
[+] Searching memory by Yara rules.
Traceback (most recent call last):
  File "/usr/bin/volatility", line 192, in <module>
    main()
  File "/usr/bin/volatility", line 183, in main
    command.execute()
  File "/usr/lib/python2.7/dist-packages/volatility/commands.py", line 147, in execute
    func(outfd, data)
  File "/usr/lib/python2.7/dist-packages/volatility/plugins/malware/malconfscan.py", line 101, in render_text
    for task, start, end, malname, memory_model, config_data in data:
  File "/usr/lib/python2.7/dist-packages/volatility/plugins/malware/malconfscan.py", line 87, in calculate
    for task, vad_base_addr, end, hit, memory_model, config_data in instance.calculate():
  File "/usr/lib/python2.7/dist-packages/volatility/plugins/malware/utils/datperscan.py", line 236, in calculate
    dec = self.custom_rc4(enc, key, rc4key_seed)
  File "/usr/lib/python2.7/dist-packages/volatility/plugins/malware/utils/datperscan.py", line 97, in custom_rc4
    for char in data:
TypeError: 'NoneType' object is not iterable
```

#volatility malconfscan -f be2.vmem/be2.vmem 

```
Volatility Foundation Volatility Framework 2.6
[+] Searching memory by Yara rules.
```

#volatility malconfscan -f coreflood.vmem/coreflood.vmem 


```
Volatility Foundation Volatility Framework 2.6
[+] Searching memory by Yara rules.
Traceback (most recent call last):
  File "/usr/bin/volatility", line 192, in <module>
    main()
  File "/usr/bin/volatility", line 183, in main
    command.execute()
  File "/usr/lib/python2.7/dist-packages/volatility/commands.py", line 147, in execute
    func(outfd, data)
  File "/usr/lib/python2.7/dist-packages/volatility/plugins/malware/malconfscan.py", line 101, in render_text
    for task, start, end, malname, memory_model, config_data in data:
  File "/usr/lib/python2.7/dist-packages/volatility/plugins/malware/malconfscan.py", line 87, in calculate
    for task, vad_base_addr, end, hit, memory_model, config_data in instance.calculate():
  File "/usr/lib/python2.7/dist-packages/volatility/plugins/malware/utils/datperscan.py", line 236, in calculate
    dec = self.custom_rc4(enc, key, rc4key_seed)
  File "/usr/lib/python2.7/dist-packages/volatility/plugins/malware/utils/datperscan.py", line 97, in custom_rc4
    for char in data:
TypeError: 'NoneType' object is not iterable
```

#volatility malconfscan -f sality.vmem/sality.vmem 


```
Volatility Foundation Volatility Framework 2.6
[+] Searching memory by Yara rules.
```

#volatility malconfscan -f silentbanker.vmem/silentbanker.vmem 


```
Volatility Foundation Volatility Framework 2.6
[+] Searching memory by Yara rules.
Traceback (most recent call last):
  File "/usr/bin/volatility", line 192, in <module>
    main()
  File "/usr/bin/volatility", line 183, in main
    command.execute()
  File "/usr/lib/python2.7/dist-packages/volatility/commands.py", line 147, in execute
    func(outfd, data)
  File "/usr/lib/python2.7/dist-packages/volatility/plugins/malware/malconfscan.py", line 101, in render_text
    for task, start, end, malname, memory_model, config_data in data:
  File "/usr/lib/python2.7/dist-packages/volatility/plugins/malware/malconfscan.py", line 87, in calculate
    for task, vad_base_addr, end, hit, memory_model, config_data in instance.calculate():
  File "/usr/lib/python2.7/dist-packages/volatility/plugins/malware/utils/datperscan.py", line 236, in calculate
    dec = self.custom_rc4(enc, key, rc4key_seed)
  File "/usr/lib/python2.7/dist-packages/volatility/plugins/malware/utils/datperscan.py", line 97, in custom_rc4
    for char in data:
TypeError: 'NoneType' object is not iterable
```

#volatility malconfscan -f tigger.vmem/tigger.vmem 


```
Volatility Foundation Volatility Framework 2.6
[+] Searching memory by Yara rules.
```


以上。