Why is DNS configuration a step in the malware remediation process?
Added by Joaquin L.
Step 1
example.com) into IP addresses that computers use to identify each other on the network. Show more…
Show all steps
Your feedback will help us improve your experience
Akash M and 50 other AP CS educators are ready to help you.
Ask a new question
Labs
Want to see this concept in action?
Explore this concept interactively to see how it behaves as you change inputs.
Key Concepts
Recommended Videos
Akash M.
Supreeta N.
Malware Analysis One of our client's machines may have been compromised by some ferocious malware. The CISO has declared an "incident" and now wants you to investigate the compromised box to determine what might be going on. The machine is located at their "super secret" engineering facility, but we are fortunate to have a virtual image of the compromised FTP Server on the SimSpace range. You can conduct a root cause analysis of the FTP server using any tools you find useful on SimSpace. You get this right and you get a permanent slot on the incident response team...if you don't, more work on the help desk. To access the FTP server, you will need to log in to your SimSpace account. Once logged in, access the range and find an available win-xp-xx VM. Click on the win-xp-xx, select the Network Tab, and record the IP address of the interface on the ISCS-Security Subnet connection. Open the win-xp-xx VM by selecting Open Console. Record what you see. At this point, you will leave this VM alone for now. Treat it as the "suspect machine". Select another VM on the range you wish to use to analyze the FTP Server. Once this is done, log in to your selected VM and open a terminal window. In the terminal window, try pinging the win-xp-xx VM that you opened. You can locate the IP address of your machine on the Network Map page located under Visualizations on the left-hand side of the screen. If you can ping your win-xp-xx VM, you are ready to go. I have gained access to the FTP server and created a user with which I can log in. The machines in this lab do not have open internet access by design. How do I analyze the infected win-xp server with a different VM in this scenario? I have access to Kali Linux and Win-Hunt machines.
Recommended Textbooks
Computer Science and Information Technology
Introduction to Programming Using Python
Computer Science - An Overview
Transcript
Watch the video solution with this free unlock.
EMAIL
PASSWORD