Source / Destinatio...
 
Notifications
Clear all

Source / Destination of Spyware

3 Posts
3 Users
0 Reactions
525 Views
(@digitalagent)
Active Member
Joined: 12 years ago
Posts: 15
Topic starter  

Hey guys,

I have a hard drive containing keyloggers detected by Gargoyle Forensic Pro. Can somebody, if possible, give details on how to go about finding the source? Also, it is suspected that the logs are being transmitted to another computer, can you please explain possible ways to go about finding where information is being sent?

All I can think of is to monitor outgoing traffic. Please let me know, my firm has plenty of tools available. Thank you.


   
Quote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

Can somebody, if possible, give details on how to go about finding the source?

What do you mean by "source"?
Who "planted" it/them or who wrote the keylogger?
For the first your chances are 0 (zero), for the second, analyzing the actual excutable or service or fake driver in a hex editor may provide you with some data.

Also, it is suspected that the logs are being transmitted to another computer, can you please explain possible ways to go about finding where information is being sent?
All I can think of is to monitor outgoing traffic. Please let me know, my firm has plenty of tools available.

Yes, that's pretty much your only option.
Please consider that the monitoring needs to be extended over a "fair" amount of time.

Usually keyloggers compress (and sometimes encrypt) the data they gather, then send them in a single "bunch of bytes" from time to time, this may be every hour/day/week or whatever and could be also triggered by the amount of keypresses recorded.
If you prefer, if you leave the PC running (but with no operations on the keyboard) and just monitor it, it is possible that no data will be sent anywhere….

jaclaz


   
ReplyQuote
keydet89
(@keydet89)
Famed Member
Joined: 21 years ago
Posts: 3568
 

I have a hard drive containing keyloggers detected by Gargoyle Forensic Pro. Can somebody, if possible, give details on how to go about finding the source?

If by "source", you mean the initial infection vector, I'd suggest creating a timeline of system and user activity. If I knew which OS and version you were looking at, I might be able to recommend some specific artifacts or data sources of interest, but I'd think that a timeline would be the best approach.


   
ReplyQuote
Share: