EKTotal: Integrated tool to analyze Drive-by Download attack

BlackHat USA 2018 Arsenal

https://github.com/nao-sec/ektotal
https://www.blackhat.com/us-18/arsenal/schedule/index.html#ektotal-11949

Transcript

1. https://78.media.tumblr.com/tumblr_lr2fpeEE7i1r2wqsxo1_r1_1280.jpg 1
3. https://blog.trendmicro.com/trendlabs-security-intelligence/a-look-into-recent-exploit-kit-activities 3
8. F I L T E R 1 F I L T E R 2 RIG Exploit Kit Analyzer W E B U I GrandSoft Exploit Kit Analyzer Magnitude Exploit Kit Analyzer Bloodlust Drive-by Analyzer @EKFiddle 8
9. Deploy -just 4 step- 9
10. Conclusion - Just submit pcap or saz file - It detects and analyzes traffic of various attack campaigns and Exploit Kits - You can know the vulnerabilities that may have been exploited, and extract malware 10