Talk : Complex malware & forensics investigation

This presentation explains how malware analyst and forensic investigator can work together. The purpose is to select several advanced threats (for example, Uroburos, ComRAT, Babar, Casper, POS…) and to show how a reverser and a forensic investigator can be complementary. The presentation is mainly based on the open source tool FastResponder. The presentation contains demo for a lot of different artifact collects and identifications.

Bio:
Paul Rascagnères: Paul Rascagnères is a malware analyst and researcher for the Sekoia’s CERT. He is specialized in Advanced Persistant Threat (APT) and incident response. He worked on several complex cases such as government linked malware or rootkits analysis. He is a worldwide speaker at several security events.
Sebastien Larinier: Sébastien Larinier currently is Senior Researcher and CTO at the CERT Sekoia located in Paris, member honeyproject chapter France and co organizer of botconf. Sébastien focused his work for the last 5 years on botnet hunting, early compromission detection, forensic and incident response. Python addict he supports different opensource projects like FastResponder, OSINT Framework,Malcom.