Upload File

malware analysis as a hobby

31
Malware Analysis as a Hobby Michael Boman - Security Consultant/Researcher, Father of 5 Siavosh Zarrasvand – Security Consultant/Researcher, Searching

Upload: michael-boman

Post on 23-Jun-2015

2.445 views

Category:

Technology


1 download

Report

Tags:

TRANSCRIPT

Page 1: Malware Analysis as a Hobby

Malware Analysis as a HobbyMichael Boman - Security Consultant/Researcher, Father of 5

Siavosh Zarrasvand – Security Consultant/Researcher, Searching

Page 2: Malware Analysis as a Hobby

Why the strange hobby?

Page 3: Malware Analysis as a Hobby

The manual way

Page 4: Malware Analysis as a Hobby

DrawbacksTime consuming

Boring in the long run (not all malware are created equal)

Page 5: Malware Analysis as a Hobby

Choose any two….Cheap

FastGood

Page 6: Malware Analysis as a Hobby

Choose any two? Why not all of them?

I can do it cheaply (hardware and license cost-wise). Human time not included.

I can do it quickly (I spend up to 3 hours a day doing this, at average even less).

I get pretty good results (quality). Where the system lacks I can compensate for its shortcomings.

Cheap

FastGood

Page 7: Malware Analysis as a Hobby

AutomateEngineer yourself out of the workflow

Automate everything!

Page 8: Malware Analysis as a Hobby

Birth of theMART ProjectMalware Analyst Research Toolkit

Page 9: Malware Analysis as a Hobby

Components

Page 10: Malware Analysis as a Hobby
Page 11: Malware Analysis as a Hobby

Sample Acquisition• Public & Private Collections• Exchange with other malware analysts• Finding and collecting malware

yourself• Download files from the web

• Grab attachments from email

• Feed BrowserSpider with links from your SPAM-folder

Page 12: Malware Analysis as a Hobby

BrowserSpider Written in Python

Using the Selenium framework to control REAL browsers Flash, PDFs, Java applets etc. executes as per normal All the browser bugs exists for real

Spiders and follows all links seen

Page 13: Malware Analysis as a Hobby

Sample Analysis• Cuckoo Sandbox• VirusTotal

Page 14: Malware Analysis as a Hobby

A days work for a CuckooFetch a task

Prepare the analysis

Lunch analyzer in virtual machine

Execute an analysis package

Complete the analysis

Store the result

Process and create reports

Page 15: Malware Analysis as a Hobby

DEMO: Submit sample for analysis

Page 16: Malware Analysis as a Hobby
Page 17: Malware Analysis as a Hobby

Sample Reporting• Results are stored in MongoDB

(optional, highly recommended)• Accessed using a analyst GUI

Page 18: Malware Analysis as a Hobby
Page 19: Malware Analysis as a Hobby
Page 20: Malware Analysis as a Hobby
Page 21: Malware Analysis as a Hobby

Data Mining

Page 22: Malware Analysis as a Hobby

Where Virtual Machine analysis fails

And what to do about it

Page 23: Malware Analysis as a Hobby

Problems Cuckoo is easly bypassed

User-detection

Sleeping malware

Page 24: Malware Analysis as a Hobby

Problems VM or Sandbox detection

The guest OS might not be sufficient enough

Any multistage attack

Page 25: Malware Analysis as a Hobby

Iterating automatiation

Sort out clearly non-malicious and obviosly malicious

samples

Devide the samples into

categories

Do brief static analysis

Known Good

Known Bad

Unknown

Page 26: Malware Analysis as a Hobby

Iterating automatiation

Sort out clearly non-malicious and obviosly malicious

samples

Devide the samples into

categories

Do brief static analysis

• Does not do anything

• Detects environment

• Encrypted segments

• Failed execution

Page 27: Malware Analysis as a Hobby

Iterating automatiation

Sort out clearly non-malicious and obviosly malicious

samples

Devide the samples into

categories

Do brief static analysis

• Run longer• Envirnoment customization

Page 28: Malware Analysis as a Hobby
Page 29: Malware Analysis as a Hobby

Budget Computer: €520

MSDN License: €800 (€590 renewal)

Year 1: €1320

Year N: €590

Money saved from stopped smoking (yearly): €2040

Page 30: Malware Analysis as a Hobby

Next steps• Barebone on-the-iron malware

analysis• Android platform support• OSX platform support• iOS patform support

Page 31: Malware Analysis as a Hobby

Questions?

Michael [email protected]

http://michaelboman.org@mboman

Siavosh [email protected]

@zarrasvand


Creating a Malware Analysis Lab and Basic Malware Analysis

13 Malware Analysis

Automated malware analysis

Malware analysis as a hobby (Owasp Göteborg)

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Intelligence Driven Malware Analysis (IDMA) Malicious ... · PDF fileIntelligence Driven Malware Analysis (IDMA) ... (GCIH) o GIAC Certified ... Intelligence Driven Malware Analysis

Malware Analysis: Citadel

Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Malware analysis

Practical Malware Analysis: Ch 11: Malware Behavior

Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static Techniques

Malware Analysis Workshop June 5, 2012 - CCDCOE · Malware Analysis Workshop June 5, 2012 ... •Malware Analysis methods ... •Some malware doesnt run in Norman Sandbox

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Malware analysis as a hobby - the short story (lightning talk)

Sodinokibi Malware Analysis

Malware Analysis as a Hobby - 44CON 2012

Advanced malware analysis training session6 malware sandbox analysis

Malware Analysis - ISWAT · The Malware Analysis Process Malware Sample Threat Intelligence Basic Static Analysis Dynamic Analysis Forensics Advanced Analysis ... Advanced Analysis

Deep Malware Analysis - Joe Sandbox Sandbox Ultimate Feature... · Sample: b19411d.js Startdate: ... Deep Malware Analysis, ... Joe Sandbox Mail Monitor Malware similarity analysis

Linux Malware Analysis

Reversing malware analysis trainingpart9 advanced malware analysis

Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Malware Analysis - Example

Advanced Malware Analysis

Malgram Malware Analysis: Malware Unpacking Static Analysis Code Deobfuscation Decompilation

Reversing & malware analysis training part 9 advanced malware analysis

Advanced Malware Analysis Training Session 6 - Malware Sandbox Analysis

Intrusion Detection and Malware Analysis - Malware collection

Malware Dynamic Analysis

Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Malware Sandbox Analysis

Basic malware analysis

Android malware analysis