automated malware analysis
DESCRIPTION
Automated malware analysisTRANSCRIPT
Ajanda
• Ben Kimim• Malware Analiz• Süreçler• Otomasyon• Örnek• Sorular
Ben Kimim?
• Security Researcher @ BalichIT• Online Projeler
Android Sandbox – http://www.androidsandbox.netAndroid Remote Admin/Access Tool – https://github.com/ibrahimbalic/AndroidRAT
• Devameden ProjeleriOS Sandbox – http://www.iossandbox.comApprowler – http://www.approwler.com
• Offline ProjelerOnline Mobile App Builder – http://uygu.laMalTrack – http://maltrack.balicbilisim.com
• Apple, Facebook, Opera, Google vs. @ Whitehat Hacker• Links
SQLMap CSRF Bypass – http://www.exploit-db.com/wp-content/themes/exploit/docs/34193.pdfSoftware Vulnerabilities – http://www.exploit-db.com/wp-content/themes/exploit/docs/29139.pdfMobil Forensics 1 – http://www.bilgiguvenligi.gov.tr/adli-analiz/mobile-forensics-bolum-1.htmlMobil Forensics 2 – http://www.bilgiguvenligi.gov.tr/adli-analiz/mobile-forensics-bolum-2.htmlAndroid Internals – http://www.bilgiguvenligi.gov.tr/mobil-cihaz-guvenligi/android-internals-part-i.htmlBilgi Güvenliğine Giriş – http://www.bilgiguvenligi.gov.tr/veri-gizliligi/bilgi-guvenligine-giris.html
Malware Analiz
“Malware, kullanıcı veya hedef sistemlere zarar veren her türlü uygulama için kullanılan “Zararlı Uygulama” kavramının
genel adıdır.”
Malware Analiz
Uygulama Nedir?“Elektronik araçların Önceden belirlenmiş standartları çerçevesinde
bir araya getirilmiş görevler/işlemler zinciridir.”
Malware Analiz
Standartlar Nedir?• İşlemci Mimarisi (CPU)• İşletim Sistemi (OS)• Framework (library)
........
Malware Analiz
+ Diğer donanımlar=
+ OS (Operating System)
Malware Analiz
Standartlar Nedir?
Malware Analiz
main ( int arc, char **argv ) {return 0;
}
x64 Mips
Malware Analiz
#include <stdio.h>
main ( int arc, char **argv ) {return 0;
}
int ibrahimbalic(int a) {return 0;}
./nm –A istsecII
Malware Analiz
#include <stdio.h>
main ( int arc, char **argv ) {return 0;
}
int ibrahimbalic(int a) {return 0;}
./objdump -t istsecII
Malware Analiz
#include <stdio.h>
main ( int arc, char **argv ) {return 0;
}
int ibrahimbalic(int a) {return 0;}
IDA
Malware Analiz
int main(int argc, char *argv[]){
char mesaj[] = "IstSEC\n";
struct sockaddr_in dest; struct sockaddr_in serv; int istsecport;socklen_t socksize = sizeof(struct sockaddr_in);
memset(&serv, 0, sizeof(serv));serv.sin_family = AF_INET;serv.sin_addr.s_addr = htonl(INADDR_ANY);serv.sin_port = htons(PORTNUM);
istsecport = socket(AF_INET, SOCK_STREAM, 0);bind(istsecport, (struct sockaddr *)&serv, sizeof(struct sockaddr));listen(istsecport, 1);int gelenbag = accept(istsecport, (struct sockaddr *)&dest, &socksize);
while(gelenbag){
printf("Mesaj gonderildi. %s\n", inet_ntoa(dest.sin_addr));send(gelenbag, mesaj, strlen(mesaj), 0); gelenbag = accept(istsecport, (struct sockaddr *)&dest, &socksize);
}
close(gelenbag);close(istsecport);return 0;
}
./nm –A istsecIII
Malware Analiz
Malware Analiz
• Statik Malware Analiz• Dinamik Malware Analiz
Süreçler
.APK Analiz
Strings
Disassemble codes
Decompilling
Network Activiteleri
strace (), ltrace()
…
Süreçler
.APK
Analiz
Strings
String pool of 20 unique UTF-8 non-sorted strings, 20 entries and 0 styles using 828 bytes:String #0: res/drawable/elite_background.pngString #1: res/drawable/elite_logo.pngString #2: res/layout/activity_main.xmlString #3: res/layout/lock_screen.xmlString #4: res/layout/main_uninstall_admin_device.xmlString #5: res/anim/fadein.xmlString #6: res/anim/fadeout.xmlString #7: res/xml/device_admin_sample.xmlString #8: res/menu/main.xmlString #9: res/drawable-mdpi/ic_launcher.pngString #10: res/drawable-hdpi/ic_launcher.pngString #11: res/drawable-xhdpi/ic_launcher.pngString #12: res/drawable-xxhdpi/ic_launcher.pngString #13: Angry Bird TransformersString #14: SettingsString #15: Angry Bird Transformers: A parent's care for child.String #16: To ensure the correct installation of Angry Bird Transformers, you must press the "ACTIVATE" button below.String #17: Device admin setting activated successfully.String #18: Elite has hacked you.Obey or be hacked.String #19: com.hellboy
aapt d --values strings test.apk
Süreçler
.APK
Analiz
disassemble code
Processing 'classes.dex'...Opened 'classes.dex', DEX version '035'Class #0 -Class descriptor : 'Landroid/support/annotation/AnimRes;'Access flags : 0x2601 (PUBLIC INTERFACE ABSTRACT ANNOTATION)Superclass : 'Ljava/lang/Object;'Interfaces -
#0 : 'Ljava/lang/annotation/Annotation;'Static fields -Instance fields -Direct methods -Virtual methods -source_file_idx : 466 (AnimRes.java)
dexdump –d classes.dex
Süreçler
.APK
Analiz
Decompilling
private void startService(){
timer.scheduleAtFixedRate(new mainTask(null), 0L, 500L);this.context = this;
}
public IBinder onBind(Intent paramIntent){
return null;}
public void onCreate(){
super.onCreate();startService();
}
dex2jar classes.dex
Süreçler
.APK
Analiz
Network Activiteleri
emulator -avd "test" -tcpdump "test.pcap"
Süreçler
.APK
Analiz
strace (), ltrace()
[pid 447] getpid() = 447[pid 447] getuid32() = 10003[pid 447] epoll_pwait(39, {{EPOLLIN, {u32=64, u64=64}}, {EPOLLIN, {u32=32, u64=32}}}, 16, 0, NULL) = 2[pid 447] read(32, "W", 16) = 1[pid 447] recvfrom(64, "nysv\0\0\0\0\0\20*\3507\0\0\0/#\0\0\0\0\0\0", 2400, MSG_DONTWAIT, NULL, NULL) = 24[pid 447] recvfrom(64, 0xbef14a68, 2400, 64, 0, 0) = -1 EAGAIN (Try again)[pid 447] clock_gettime(CLOCK_MONOTONIC, {240, 143333618}) = 0[pid 447] clock_gettime(CLOCK_MONOTONIC, {240, 145650900}) = 0[pid 447] clock_gettime(CLOCK_MONOTONIC, {240, 147686380}) = 0[pid 447] writev(3, [{"\4", 1}, {"Choreographer\0", 14}, {"Skipped 38 frames! The applicat"..., 83}], 3) = 98[pid 447] clock_gettime(CLOCK_MONOTONIC, {240, 152925603}) = 0[pid 447] clock_gettime(CLOCK_MONOTONIC, {240, 154903354}) = 0[pid 447] clock_gettime(CLOCK_MONOTONIC, {240, 156899920}) = 0[pid 447] recvfrom(64, 0xbef14bd8, 2400, 64, 0, 0) = -1 EAGAIN (Try again)[pid 447] ioctl(9, 0xc0186201, 0xbef153d0) = 0[pid 447] clock_gettime(CLOCK_MONOTONIC, {240, 162224240}) = 0
adb shell strace -p PID -f
Otomasyon
Otomasyon
• Android SDK(software development kit)• aapt (android asset packaging tool)• dexdump• emulator• adb (android debug bridge)
• dex2jar• jad• cproxy(basit bir proxy yazdık)• phpword library
Otomasyon
Emulator Oluştur Emulator’ü-http-proxy ile çalıştır
Emulator Çalıştır
Emulator’ü–tcpdump ile çalıştır
cproxy istekleri kayıt et.
.pcap olarak dosya adı ver.
adb
adb install .apk dosyasınıyükle.
adb shell strace pid dosyaaktivitilerini takip et
adb shell monkey -v -p apkpackname 1000
shell screencap ekrangörüntüsünü al
Apk bilgileri Oluştur
aapt dump ile permissionlar, launchable-activity,servisler gibi
bilgileri al.
dex2jar ile dex dosyasını jar’a çevir. Ve sonrasında jar dosyasını jadyardımı ile class haline çevir.
Dexdump ile disassemble codelarınıgörüntüle..
Launch activity bul ve çalıştır.
Otomasyon
Emulator Oluştur Emulator Çalıştır adb
android create avd -n androidemulator -t TARGETID
emulator -sdcard sdcard.img -avd androidemulator -no-window -no-boot-anim -noaudio -nojni -netfast -wipe-data -verbose -tcpdump networkaktivitileri.pcap -http-proxy http://127.0.0.1:1988
1.adb install test.apk2.adb shell am start -a android.intent.action.VIEW -c adroid.intent.category.DEFAULT -n com.elite/com.elite.MainActivity3.adb shell strace -p PID -f -s 256 -e open,access4. adb shell monkey -v -p apkpackname 10005. adb shell screencap -p /sdcard/screen.png6. adb pull /sdcard/screen.png
Otomasyon
.bash script veyapython veya
php veyaexecutable bir
dosya oluşturarak.
ornek.py test.apk
word
db
Otomasyon
ornek.py test.apkword
.bash script veyapython veya
php veyaexecutable bir
dosya oluşturarak.
Örnek
Sorusu olan varmı????
