Upload File

malware analysis

39
introducing Malware Analysis

Upload: prakashchandra-suthar

Post on 04-Aug-2015

79 views

Category:

Education


1 download

Report

Tags:

TRANSCRIPT

Page 1: Malware analysis

introducing

Malware Analysis

Page 2: Malware analysis

Agenda

1Intro and Recent

Malware Attack

3Make Your Own

Malware Analysis toolkit

Malware Analysis &

Types2

Page 3: Malware analysis

• Generally–Any code that perform evil…

• Today–Executable content with unknown functionality that

is resident on a system of investigative interest• Virus• Worms• Spyware• Adware• Rootkits

Malware?

HA HA HAHAH

A..!

Page 4: Malware analysis

Family of Malware

Page 5: Malware analysis

• Fame • Money $$• It’s a Business (not a kiddie) • Antivirus

Why build Malware ?

Page 6: Malware analysis

•Why Analyze Malware?• To assess damage• To discover indicators of compromise• To identify vulnerability• To catch the “Bad Guy”• To answer questions…

Analyzing Malware

Page 7: Malware analysis

Attacks in Synerzip

• 2007– DNS hacked

• 2008 – FTP Server Hacked

• 2010 – DDOS on the DNY Network

• 2011– Dos attack on DNS Server– False Dos attack on Firewall due to Quickoffice Connect Application bug

• 2013 – Router Hacked @ DNY, Botnet Zeroaccess

• 2014 – Zibmra VLAN MITM

• Note – No Network is 100% secured, but we can make things difficult for the hackers

Page 8: Malware analysis

Recent malware attacks

Page 9: Malware analysis

What is Cryptolocker?

• Began September 2013 • Encrypts victim’s files, asks for $300

ransom• Impossible to recover files without a key• Ransom increases after deadline• Goal is monetary via Bitcoin• 250,000+ victims worldwide

(According to Secureworks)

Page 10: Malware analysis
Page 11: Malware analysis

Who pays the ransom?

Police department paid $750 to decrypt images and word documents

Page 12: Malware analysis

NightHunter – Name explained

NightHunter, because of its use of SMTP (email) for data exfiltration. Email is often overlooked, so it can be a more stealthy way of data theft, akin to hunting at night.

Page 13: Malware analysis

NightHunter Infections To Date

There are at least 1,800 unique infections

3OWL

Ieindia

Drmike

Hanco

Gmail

Comcast

1000

350

200

150

100*

60

Number of unique infections per email server

Page 14: Malware analysis

NightHunter DeliveryEmail subject/attachment names:• Jobs List• Inquiry• Order• PO• Purchase Order• Payment Slip• Reconfirm Pls• Remittance Payment

Slip• WireSlip

Page 15: Malware analysis

NightHunter – How it works?

Page 16: Malware analysis

ZeroAccess Botnet

• Also known as– 0Access– Sirefef– Maxplus– Smiscer

Page 17: Malware analysis

Spreads Via

• Drive-by-Download sites• Keygen and crack programs(Games)• Fake game downloads

Page 18: Malware analysis

Capabilities

• Download malware updates via Peer to Peer protocol (Ports – 16464, 16465, 16470 and 16471 )

• Deploy a rootkit to avoid detection• Disable Anti-Virus and Anti-Malware software

Page 19: Malware analysis

Money

• Click fraud – Instruct bots to visit• Spam• Bitcoin Mining – Small number of varients

Page 20: Malware analysis

How it works?

Page 21: Malware analysis

• Static (Source Code) Analysis• Dynamic (Behavioral) Analysis• Sandboxing

How To Analyze Malware

Page 22: Malware analysis

Static Analysis “The Dissection”

Page 23: Malware analysis

Index

• File hashing• File type identification• Packer/Compiler Identification • Entropy Analysis • Strings• PE Header Analysis• Verify Signature• Disassemble• PDF Shell code analysis

Page 24: Malware analysis

DYNAMIC (BEHAVIORAL) ANALYSIS

Page 25: Malware analysis

Dynamic (Behavioral) Analysis

• Static Analysis will reveal some immediate information

• Exhaustive static analysis could theoretically answer any question, but it is slow and hard

• Usually you care more about “what” malware is doing than “how” it is being accomplished

• Dynamic analysis is conducted by observing and manipulating malware as it runs

Page 26: Malware analysis

System Monitoring

• What we are after• Registry Activity• File Activity• Process Activity• Network Traffic

Page 27: Malware analysis
Page 28: Malware analysis
Page 29: Malware analysis

Anti Techiniques

• Anti-virtualization• Anti-Debugging • Anti-Disassembling• Anti-Sandboxing

Page 30: Malware analysis

Make your own Malware Analysis Toolkit Using Free Tools

Page 31: Malware analysis

Step 1: Allocate physical or virtual systems for the analysis lab

• Virtualization software options include – VMware Server– Windows Virtual PC– Microsoft Virtual Server– VirtualBox

Page 32: Malware analysis

Step 2: Isolate laboratory systems from the production environment

• Separate the laboratory network from production using a firewall

• Don't connect laboratory and production networks at all

• Use removable media to bring tools and malware into the lab

• Don't use the physical machine that's hosting your virtualized lab for any other purpose.

Page 33: Malware analysis

Step 3: Install behavioral analysis tools

• File system and registry monitoring: – Process Monitor– Capture BAT

• Process monitoring:– Process Explorer– Process Hacker

• Network monitoring:– Wireshark – SmartSniff

• Change detection :– Regshot

Page 34: Malware analysis

Step 4: Install code-analysis tools

• Disassembler and debugger:– OllyDbg / Immunity Debugger– IDA Pro

• Memory dumper:– LordPE – OllyDump

Page 35: Malware analysis

Utilize online analysis tools

• Anubis• CWSandbox• Joebox• Norman SandBox• ThreatExpert• Malwr

Page 36: Malware analysis

Cuckoo Sandbox Automated Malware Analysis

Page 37: Malware analysis

Malware Analysis Video

Page 38: Malware analysis

Questions????Thank You

Page 39: Malware analysis

Malware Dynamic Analysis

2016 HITCON Malware is In the Memory · Cuckoo Sandbox - Malware Automatic Analysis System - Windows ... . ... New Malware Analysis System

Advanced(Malware(AnalysisTrainingSeries - Zenk - … . cracking/Advanced... · Advanced Malware Analysis Training !!!!! This presentation is part of our Advanced Malware Analysis

Tasty Malware Analysis with T.A.C.O. - FIRST · Tasty Malware Analysis with T.A.C.O. ... Malware Analysis Challenges ... • DLL Side-loading 9. Cuckoo Sandbox • Popular open-source

Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis

Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis

Reversing malware analysis trainingpart9 advanced malware analysis

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Advanced Malware Analysis

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Basic malware analysis

Malware Analysis - ISWAT · The Malware Analysis Process Malware Sample Threat Intelligence Basic Static Analysis Dynamic Analysis Forensics Advanced Analysis ... Advanced Analysis

Malware Analysis - Example

Malware Analysis Machine Learning Approach - DeepSec · Malware Analysis Machine Learning Approach ... malware activities Memory Analysis the act of analyzing a dumped memory image

Malgram Malware Analysis: Malware Unpacking Static Analysis Code Deobfuscation Decompilation

Automating Malware Analysis

Malware Sandbox Analysis

Sodinokibi Malware Analysis

Practical Malware Analysis: Ch 11: Malware Behavior

Automated malware analysis

Android malware analysis

Deep Malware Analysis - Joe Sandbox Sandbox Ultimate Feature... · Sample: b19411d.js Startdate: ... Deep Malware Analysis, ... Joe Sandbox Mail Monitor Malware similarity analysis

Advanced malware analysis training session6 malware sandbox analysis

Malware Analysis Workshop June 5, 2012 - CCDCOE · Malware Analysis Workshop June 5, 2012 ... •Malware Analysis methods ... •Some malware doesnt run in Norman Sandbox

Reversing & malware analysis training part 9 advanced malware analysis

Intrusion Detection and Malware Analysis - Malware collection

Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static Techniques

Malware Analysis: Citadel

Malware Analysis Basics

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Malware Analysis Techniques

Creating a Malware Analysis Lab and Basic Malware Analysis

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Intelligence Driven Malware Analysis (IDMA) Malicious ... · PDF fileIntelligence Driven Malware Analysis (IDMA) ... (GCIH) o GIAC Certified ... Intelligence Driven Malware Analysis