RAM בטוח MALWARE סקריפט אוטומציה לבדיקת

הסקריפט הזה מיועד לחיפוש VIRUS בתוח RAM FILE

בשביל שהסקריפט יעבוד תורידו את vol.py כאן

גם אתכם צריכים להוריד TEKDEFENDER

ותקשיבו להורהות וכמובן להפעיל רק על LINUX

#!/bin/bash

tput setaf 1 echo "please input your RAM FILE in this directory"

echo "please input your vol.py in this directory"

echo "please use pwd in this directory"

read name

echo "please give me your name file (ram file)"

read ram

mkdir dumpfiles ;

echo "please use pwd command in the folder dumpfiles and give me the path"

read pwd

echo "please use pwd in the TekDefencefolder"

read take

./vol.py -f $ram imageinfo ;

echo "please take the complete name of the os in the line Suggested Profile the first if is doesn't work the second and if is donsn't work the third"

echo "and give me the full name of the os"

read os

./vol.py -f $ram --profile $os pslist > pslist.txt

echo "this is a processlist"

./vol.py -f $ram --profile $os psscan > psscan.txt

echo "this is steel processlist"

./vol.py -f $ram --profile $os svcscan> service.txt

echo "this is a servicelist"

./vol.py -f $ram --profile $os svcscan > svcscan.txt

echo "this is a commandlist"

./vol.py -f $ram --profile $os console > console.txt

echo "this is a cmdlist"

./vol.py -f $ram --profile $os cmdscan > cmdscan.txt

echo "this is a cmdline "

./vol.py -f $ram --profile $os cmdline > cmdline.txt

echo "this is a REGISTERYfile"

./vol.py -f $ram --profile $os hivelist > hivelist.txt

echo "this is a hashfile"

./vol.py -f $ram --profile $os hashdump > hashdump.txt

echo "this is a lsahash"

./vol.py -f $ram --profile $os lsadump > lsadump.txt

echo "this is a network scan "

./vol.py -f $ram --profile $os netscan > netscan.txt

echo "this is another networkscan"

./vol.py -f $ram --profile $os connections > connection.txt

echo "this is another networkscan "

./vol.py -f $ram --profile $os conscan > conscan.txt

echo "this is a malware test file"

./vol.py -f $ram --profile $os malfind > malfind.txt

echo "this is a REGISTERYFILE"

./vol.py -f $ram --profile $os printkey > printkey.txt

echo "THIS IS A FILEDUMPS ALL THE FILE ON THE RAM"

./vol.py -f $ram --profile $os dumpfiles -D $pwd ;

cd dumpfiles ;

foremost -t all * ;

cd output ;

cd exe ;

md5sum * > hash.txt

cat hash.txt | cut -d " " -f 1 > hash2.txt

cp hash2.txt $take ;

cd $name ;

cd TekDefense-Automater-master ;

for i in $(cat hash2.txt); do python Automater.py $i ; done > virustotal.txt

cp virustotal.txt $name ;

ליצירת קשר ושירות טכנאי מחשבים בירושלים עד הבית חייגו – 0532104457