Ploutus-ATM-malware-Detector

KO | EN

gitlite — search

#typescript #llm #go #android #machine-learning #rust #deep-learning #linux #java #awesome #awesome-list #vue #mcp #open-source

Ploutus-ATM-malware-Detector

(★ 12)

Detection: Identify the presence of the Ploutus malware by checking for known indicators of compromise (IoCs) such as specific files, registry keys, or processes. Response: Take proper measures such as stopping malicious processes, removing malicious files, and notifying administrators.

Ploutus-ATM-malware-Detector 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Ploutus-ATM-malware-Detector
Detection: Identify the presence of the Ploutus malware by checking for known indicators of compromise (IoCs) such as specific files, registry keys, or processes. Response: Take proper measures such as stopping malicious processes, removing malicious files, and notifying administrators.

DetectAndRespondToPloutusMalware.ps1
Overview

DetectAndRespondToPloutus.ps1 is a PowerShell script designed to detect and respond to Ploutus ATM malware. This script performs several key tasks:

Detection: Identifies the presence of Ploutus malware by checking for known indicators of compromise (IoCs) such as malicious processes, files, and registry keys.
    Response: Takes appropriate actions including stopping malicious processes, removing malicious files, and cleaning up registry keys.
    Notification: Sends email notifications about detected and removed threats.

Features

Detects and stops malicious processes.
    Removes known malicious files and registry keys.
    Verifies file hashes to identify malicious files.
    Logs actions to a log file.
    Sends email notifications for critical events.

Prerequisites

PowerShell: Ensure you are running PowerShell with appropriate permissions.
    SMTP Server: Configure the script with valid SMTP server settings to enable email notifications.
    Permissions: The script requires sufficient permissions to terminate processes, remove files, and modify registry keys.

Configuration
SMTP Settings

Update the SMTP configuration in the Send-Notification function:

$smtpServer: The address of your SMTP server.
    $smtpFrom: The email address from which notifications will be sent.
    $smtpTo: The email address where notifications will be sent.
    $smtp.EnableSsl: Set to $true to enable SSL.
    $smtp.Credentials: Provide valid credentials for your SMTP server.

IoCs

Modify the following arrays to include known IoCs for Ploutus malware:

$maliciousProcesses: List of known malicious process names.
    $maliciousFiles: List of known malicious file paths.
    $maliciousRegistryKeys: List of known malicious registry keys.
    $maliciousSHA256: List of known malicious file hashes.
    $maliciousFileNames: List of known malicious file names.

Usage
Update Configuration: Edit the script to configure SMTP settings and IoCs as described in the Configuration section.
Run the Script: Execute the script in PowerShell with appropriate permissions.

.\DetectAndRespondToPloutus.ps1
 Monitor Logs: Review the log file located at C:\ATM_Security\PloutusDetectionLog.txt for details on actions taken.
 Check Notifications: Ensure email notifications are received as per the configured settings.

Functions

Get-FileHashSHA256: Computes the SHA256 hash of a file.
Stop-MaliciousProcesses: Identifies and stops known malicious processes.
Remove-MaliciousFiles: Removes known malicious files by path.
Detect-And-RemoveMaliciousFileNames: Searches for and removes files based on known malicious names.
Remove-MaliciousRegistryKeys: Removes known malicious registry keys.
Log-DetectionResponse: Logs detection and response actions.
Send-Notification: Sends email notifications for critical events.
Detect-And-Respond: Main function that coordinates detection and response operations.

Error Handling

The script includes error handling for:

File hash computation
Process stopping
File and registry removal
Email notification sending

Errors are logged to the log file with details on the issue encountered. Security Considerations

Permissions: Run the script with the least privilege necessary.
Registry Access: Carefully validate registry paths to avoid accidental deletion of critical keys.
Credentials: Securely manage SMTP credentials and avoid hard-coding sensitive information in the script.

Testing

Before deploying the script in a production environment:

Test it in a controlled environment to validate functionality.
Monitor performance and adjust as necessary to handle large filesystems or numerous processes.

Contributions

If you have suggestions or improvements for this script, please feel free to contribute by submitting a pull request or opening an issue on the repository. License

This script is provided as-is. Use it at your own risk. The author(s) are not responsible for any damages or issues that arise from using this script. Contact

For questions or support, please contact tadash10@protonmail.com This README is intended to provide comprehensive guidance on the DetectAndRespondToPloutus.ps1 script. Ensure that all configurations are tailored to fit your environment and security requirements.

Feel free to adjust the placeholders (like SMTP settings and email addresses) and specific details according to your actual setup and requirements. This README should provide a clear guide to users for configuring, using, and maintaining the script effectively.

Backdoor.Ploutus:

This report is generated from a file or URL submitted to this webservice on July 7th 2015 06:31:16 (UTC)
Falcon Sandbox © Hybrid Analysis:

Attention: this analysis ran with the legacy Usermode Monitor. It is highly recommended to use the Kernelmode Monitor.
Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

Malicious Indicators 1
    General
        Sample was identified as malicious by at least one Antivirus engine

Suspicious Indicators 1
    Anti-Reverse Engineering
        PE file has unusual entropy sections

File Details
All Details:
Backdoor.Ploutus.B

Filename
    Backdoor.Ploutus.B
Size
    32KiB (32768 bytes)
Type
    peexe assembly executable 
Description
    PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Architecture
    WINDOWS
SHA256
    d99339d3dc6891cdd832754c5739640c62cd229c84e04e9e3cad743c6f66b1b9Copy SHA256 to clipboard

Resources

Language
    NEUTRAL
Icon
    Sample Icon

Visualization

Input File (PortEx)
    PE Visualization

Version Info

Translation
    0x0000 0x04b0 
LegalCopyright
    Copyright Ploutos 2013 
Assembly Version
    1.0.0.0 
InternalName
    Ploutos.exe 
FileVersion
    1.0.0.0 
CompanyName
    Ploutos 
ProductName
    Ploutos 
ProductVersion
    1.0.0.0 
FileDescription
    Ploutos 
OriginalFilename
    Ploutos.exe

Classification (TrID)

82.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.)
    7.4% (.DLL) Win32 Dynamic Link Library (generic)
    5.1% (.EXE) Win32 Executable (generic)
    2.2% (.EXE) Generic Win/DOS Executable
    2.2% (.EXE) DOS Executable Generic

File Sections

Name
    .text
Entropy
    7.41893699289
MD5
    4a6c467cf8ac862868ae48514641c0bc

Name
    .rsrc
Entropy
    3.96933471853
MD5
    62363ab6ed04c8423c7cf057b215c73c

Name
    .reloc
Entropy
    0.0815394123432
MD5
    0e35c3c4a8d0b619f76c61300b90ec01

File Resources

Name
    RT_VERSION
Type
    data
Language
    Neutral

Name
    RT_MANIFEST
Type
    XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Language
    Neutral

File Impor
Key Points of the Script:

IoC Definitions: Lists of malicious processes, files, and registry keys are defined based on known indicators.
    Stop-MaliciousProcesses: Stops any running malicious processes identified in the list.
    Remove-MaliciousFiles: Deletes any malicious files found on the system.
    Remove-MaliciousRegistryKeys: Deletes any malicious registry keys.
    Log-DetectionResponse: Logs detection and response actions to a file for auditing and tracking.
    Detect-And-Respond: The main function that orchestrates detection and response actions.

Ploutus-ATM-malware-Detector

Ploutus-ATM-malware-Detector 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Ploutus-ATM-malware-Detector

Ploutus-ATM-malware-Detector 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README