HaboMalHunter is a sub-project of Habo Malware Analysis System (https://habo.qq.com), which can be used for automated malware analysis and security assessment on the Linux system.
make
gcc -g -O0 -m64 -o target_loader.64.elf main.c
gcc -g -O0 -m32 -o target_loader.32.elf main.c
In file included from /usr/include/features.h:385,
from /usr/include/stdio.h:28,
from main.c:21:
/usr/include/gnu/stubs.h:7:27: error: gnu/stubs-32.h: No such file or directory
make: *** [all] Error 1
make install
cp ./target_loader.*.elf ../../bin/
cp: cannot create regular file `../../bin/': Is a directory
make: *** [install] Error 1
cd ..
cd ..
cd util/inetsim
unzip -o -qq inetsim.zip
cd ..
cd ..
cd util/yara
bash build.sh
include "./malware/MALW_Linux_Gates.yar"
include "./malware/MALW_Linux_Gafgyt.yar"
index.yar has been generated.
Traceback (most recent call last):
File "./compile_yara.py", line 22, in
import yara
ImportError: No module named yara
cd ..
cd ..
cd log/
package.sh: line 46: cd: log/: No such file or directory
rm -rf '/tmp/AnalyzeControl_*'
++ /bin/date +%m%d
file_name=/tmp/AnalyzeControl_0204.zip
rm -rf /tmp/AnalyzeControl_0204.zip
7z a -r /tmp/AnalyzeControl_0204.zip .
package.sh: line 53: 7z: command not found
cp /tmp/AnalyzeControl_0204.zip .
cp: cannot stat `/tmp/AnalyzeControl_0204.zip': No such file or directory
for source in '$BIN_32_LIST'
++ basename fork.c .c
base=fork
mod=32
cmd='gcc -m32 -o bin/fork.32.elf fork.c'
gcc -m32 -o bin/fork.32.elf fork.c
In file included from /usr/include/features.h:385,
from /usr/include/stdio.h:28,
from fork.c:13:
/usr/include/gnu/stubs.h:7:27: error: gnu/stubs-32.h: No such file or directory
for source in '$BIN_32_LIST'
++ basename dns.c .c
base=dns
mod=32
cmd='gcc -m32 -o bin/dns.32.elf dns.c'
gcc -m32 -o bin/dns.32.elf dns.c
In file included from /usr/include/features.h:385,
from /usr/include/stdio.h:28,
from dns.c:13:
/usr/include/gnu/stubs.h:7:27: error: gnu/stubs-32.h: No such file or directory
for source in '$BIN_32_LIST'
++ basename read.c .c
base=read
mod=32
cmd='gcc -m32 -o bin/read.32.elf read.c'
gcc -m32 -o bin/read.32.elf read.c
In file included from /usr/include/features.h:385,
from /usr/include/stdio.h:28,
from read.c:13:
/usr/include/gnu/stubs.h:7:27: error: gnu/stubs-32.h: No such file or directory
for source in '$BIN_32_LIST'
++ basename write.c .c
base=write
mod=32
cmd='gcc -m32 -o bin/write.32.elf write.c'
gcc -m32 -o bin/write.32.elf write.c
In file included from /usr/include/features.h:385,
from /usr/include/stdio.h:28,
from write.c:13:
/usr/include/gnu/stubs.h:7:27: error: gnu/stubs-32.h: No such file or directory
for source in '$BIN_32_LIST'
++ basename self_delete.c .c
gcc -m32 -o bin/self_delete.32.elf self_delete.c
In file included from /usr/include/features.h:385,
from /usr/include/stdio.h:28,
from self_delete.c:13:
/usr/include/gnu/stubs.h:7:27: error: gnu/stubs-32.h: No such file or directory
for source in '$BIN_32_LIST'
++ basename libc_file.c .c
gcc -m32 -o bin/libc_file.32.elf libc_file.c
In file included from /usr/include/features.h:385,
from /usr/include/stdio.h:28,
from libc_file.c:13:
/usr/include/gnu/stubs.h:7:27: error: gnu/stubs-32.h: No such file or directory
for source in '$BIN_32_LIST'
++ basename system.c .c
base=system
mod=32
cmd='gcc -m32 -o bin/system.32.elf system.c'
gcc -m32 -o bin/system.32.elf system.c
In file included from /usr/include/features.h:385,
from /usr/include/stdio.h:28,
from system.c:13:
/usr/include/gnu/stubs.h:7:27: error: gnu/stubs-32.h: No such file or directory
for source in '$BIN_64_LIST'
++ basename fork.c .c
base=fork
mod=64
LD_FLAGS=-lcurl
cmd='gcc -m64 -o bin/fork.64.elf fork.c -lcurl'
gcc -m64 -o bin/fork.64.elf fork.c -lcurl
/usr/bin/ld: cannot find -lcurl
collect2: ld returned 1 exit status
for source in '$BIN_64_LIST'
++ basename dns.c .c
base=dns
mod=64
LD_FLAGS=-lcurl
cmd='gcc -m64 -o bin/dns.64.elf dns.c -lcurl'
gcc -m64 -o bin/dns.64.elf dns.c -lcurl
/usr/bin/ld: cannot find -lcurl
collect2: ld returned 1 exit status
for source in '$BIN_64_LIST'
++ basename read.c .c
base=read
mod=64
LD_FLAGS=-lcurl
cmd='gcc -m64 -o bin/read.64.elf read.c -lcurl'
gcc -m64 -o bin/read.64.elf read.c -lcurl
/usr/bin/ld: cannot find -lcurl
collect2: ld returned 1 exit status
for source in '$BIN_64_LIST'
++ basename write.c .c
base=write
mod=64
LD_FLAGS=-lcurl
cmd='gcc -m64 -o bin/write.64.elf write.c -lcurl'
gcc -m64 -o bin/write.64.elf write.c -lcurl
/usr/bin/ld: cannot find -lcurl
collect2: ld returned 1 exit status
for source in '$BIN_64_LIST'
++ basename self_delete.c .c
gcc -m64 -o bin/system.64.elf system.c -lcurl
/usr/bin/ld: cannot find -lcurl
collect2: ld returned 1 exit status
for source in '$BIN_64_LIST'
++ basename http.c .c
base=http
mod=64
LD_FLAGS=-lcurl
cmd='gcc -m64 -o bin/http.64.elf http.c -lcurl'
gcc -m64 -o bin/http.64.elf http.c -lcurl
http.c:14:23: error: curl/curl.h: No such file or directory
http.c: In function ‘main’:
http.c:17: error: ‘CURL’ undeclared (first use in this function)
http.c:17: error: (Each undeclared identifier is reported only once
http.c:17: error: for each function it appears in.)
http.c:17: error: ‘curl’ undeclared (first use in this function)
http.c:18: error: ‘CURLcode’ undeclared (first use in this function)
http.c:18: error: expected ‘;’ before ‘res’
http.c:22: error: ‘CURLOPT_URL’ undeclared (first use in this function)
http.c:23: error: ‘CURLOPT_FOLLOWLOCATION’ undeclared (first use in this function)
http.c:24: error: ‘res’ undeclared (first use in this function)
http.c:25: error: ‘CURLE_OK’ undeclared (first use in this function)
for source in '$BIN_64_LIST'
++ basename https.c .c
base=https
mod=64
LD_FLAGS=-lcurl
cmd='gcc -m64 -o bin/https.64.elf https.c -lcurl'
gcc -m64 -o bin/https.64.elf https.c -lcurl
https.c:14:23: error: curl/curl.h: No such file or directory
https.c: In function ‘main’:
https.c:18: error: ‘CURL’ undeclared (first use in this function)
https.c:18: error: (Each undeclared identifier is reported only once
https.c:18: error: for each function it appears in.)
https.c:18: error: ‘curl’ undeclared (first use in this function)
https.c:19: error: ‘CURLcode’ undeclared (first use in this function)
https.c:19: error: expected ‘;’ before ‘res’
https.c:20: error: ‘CURL_GLOBAL_DEFAULT’ undeclared (first use in this function)
https.c:23: error: ‘CURLOPT_URL’ undeclared (first use in this function)
https.c:24: error: ‘CURLOPT_SSL_VERIFYPEER’ undeclared (first use in this function)
https.c:25: error: ‘CURLOPT_SSL_VERIFYHOST’ undeclared (first use in this function)
https.c:26: error: ‘res’ undeclared (first use in this function)
https.c:27: error: ‘CURLE_OK’ undeclared (first use in this function)
7z a -r test.32.zip 'bin/*.32.elf'
build.sh: line 46: 7z: command not found
7z a -r test.64.zip 'bin/*.64.elf'
build.sh: line 48: 7z: command not found
7z a -r test.all.zip bin/
build.sh: line 50: 7z: command not found
7z a -r test.mult.zip bin/
build.sh: line 52: 7z: command not found
7z a test.mult.zip bin build.sh dns.c fork.c http.c https.c libc_file.c mini_elf read.c self_delete.c sy
stem.c write.c
build.sh: line 53: 7z: command not found
cd ..
++ /bin/date +%m%d
7z a -r test_0204.zip test
package.sh: line 60: 7z: command not found
`
运行 bash package.sh 报错如下
package.sh: line 60: 7z: command not found