{"id":96812,"date":"2024-11-27T15:24:35","date_gmt":"2024-11-27T07:24:35","guid":{"rendered":"https:\/\/version-2.com\/?p=96812"},"modified":"2024-11-20T17:09:59","modified_gmt":"2024-11-20T09:09:59","slug":"etec-2024-why-botnet-tracking-is-so-effective","status":"publish","type":"post","link":"https:\/\/version-2.com\/zh\/2024\/11\/etec-2024-why-botnet-tracking-is-so-effective\/","title":{"rendered":"ETeC 2024: Why botnet tracking is so effective"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\"\"<\/p>

ESET has been successfully utilizing botnet tracking for years.\u00a0 <\/em><\/p>

When cybersecurity vendors invest heavily into sophisticated malware replication mechanisms studying real-life malware behavior in isolated environments, one may ask what the point of malware tracking is. What do we learn by extracting data from malicious code without it running or communicating with a command and control (C&C) server?<\/p>

Using the Grandoreiro banking trojan <\/a>as an example, ESET senior malware researcher Jakub Sou\u010dek explained the pros and cons of botnet tracking and malware replication at the ESET Technology Conference 2024<\/a>, an annual ESET conference discussing the best in ESET security and research.<\/p>

If you want to know more about how ESET participated in the Grandoreiro disruption, check out our other blog discussing the case at length.<\/p><\/div>

ESET tracking systems<\/h3><\/header>

With malware tracking, researchers need to implement a dedicated program (parser) for the relevant malware family deployed on the targeted machine. With this tool, the malware is nothing more than an input to such a program.<\/p>

Using a heuristic approach, code patterns, and analytical output, the parser extracts all interesting information from the malware sample without it running or communicating. It can also emulate the C&C protocol and lure even more information from the C&C server.<\/p>

\u201cAt ESET, botnet tracking has proven to be an invaluable resource several times in recent years,\u201d Sou\u010dek said.<\/p>

ESET researchers have utilized such tracking in cases like the Trickbot disruption<\/a>, which infested over a million computing devices between 2016 and 2020, the pervasive malware family Emotet<\/a>, and a large variety of infostealers and remote access trojans (RATs).<\/p>

The ESET tracking system is designed with the following objectives in mind:<\/strong><\/p>