Monday, September 8, 2014

Wanderer

I was on a test event where we wanted to test the incident response system against several different types of malware. The customer was against using live malware so I developed a "worm" like application. It propagates through the networking looking for Windows boxes which have left the Admin share open. It uses a method like PSExec to move and install itself on each box as a service. This provided a great way test malware behavior without doing anything very malicious. I did add an option which allowed for a payload to be attached to the worm. This allowed me to use Wanderer to test other malware scenarios as well. Checkout my GitHub page for more details and the code. I hope to continue development to make improvements and add more features.

2 comments: