WDavid404
commented
1 year ago MAL: Malware Introductory
malware analysis
When analysing malware, it is important to consider the following:
- Point of Entry (PoE) I.e. Was it through spam that our e-mail filtering missed and the user opened the attachment? Let's review our spam filters and train our users better for future prevention!
- What are the indicators that malware has even been executed on a machine? Are there any files, processes, or perhaps any attempt of "un-ordinary" communication?
- How does the malware perform? Does it attempt to infect other devices? Does it encrypt files or install anything like a backdoor / Remote Access Tool (RAT)?
- Most importantly - can we ultimately prevent and/or detect further infection?!
Malware Campaigns
Two types: Targeted and Mass Campaign
Targeted （標的型）
malware attacks that occur this way are created for a specific purpose against a specific target. Example: DarkHotel : is designed to steal information such as authentication details from government officials.
Mass Campaign「マス・キャンペーン」
Companies such as Kaspersky to name one, track these campaigns (known as Advanced Persistent Threats (APTs) and often report on their infection rate and indicators.
Identifying if a Malware Attack has Happened
The ultimate process of a malware attack can be broken down into a few broad steps:
- Delivery
- Execution: Here's the main part of how we classify Malware. What does it actually do? If it encrypts files - it's Ransomware! If it records information like keystrokes or displays adware - we can classify it as Spyware.
- Maintaining persistence (not always the case!)
- Propagation (not always!)
Two categories of fingerprints:
- Host-Based Signatures
- Network-Based Signatures
Static Vs. Dynamic Analysis
MD5 Checksums of Provided Files
MD5 sum against websites such as Virustotal
Identifying if the Executables are obfuscated / packed
PeID (https://github.com/wolfram77web/app-peid)
PEiD detects most common packers, cryptors and compilers for PE files. It can currently detect more than 600 different signatures in PE files.
IDA Freeware IDA Freeware is a disassembler and debugger software for Windows, Linux, and macOS that allows you to analyze binary files, executable files, and firmware. It is often used by reverse engineers, malware analysts, and security researchers.
Click the Imports tab (second last tab)
Strings
Microsoft's Sysinternals "Strings" program to output the retained strings within the specified file.
e.g
strings "C:\Users\Analysis\Desktop\Tasks\Task 12\67844C01"
Strings工具只有CUI界面，可以使用“PE Explorer”工具更方便！
After importing the target software, Navigate to "View -> Imports"
Why are "strings" important?
Illustrated below is an example of an Android Application containing sensitive credentials within strings:
其他工具
Ghidra ： https://ghidra-sre.org/
A software reverse engineering (SRE) suite of tools developed by NSA's Research Directorate in support of the Cybersecurity mission。
history of malware
skip