![Example Assembly
MOV AX, 47104
MOV DS, AX
MOV [3998], 36
INT 32
Each line is one CPU-level instruction](https://image.slidesharecdn.com/intro2malwareanalysisshort-130103001504-phpapp01/85/Intro2-malwareanalysisshort-124-320.jpg)
![Example Assembly
MOV AX, 47104
MOV DS, AX
MOV [3998], 36
INT 32
Tells the computer to copy the
number 47104 into the location AX](https://image.slidesharecdn.com/intro2malwareanalysisshort-130103001504-phpapp01/85/Intro2-malwareanalysisshort-125-320.jpg)
Uploaded byVincent Ohprecio
Intro2 malwareanalysisshort
This document provides an introduction to malware analysis through a presentation. It discusses key concepts like Zeus malware, behavioral analysis through tools like NetworkMiner and Wireshark, reverse engineering malware using tools like OllyDbg, and submitting samples to VirusTotal for analysis. The presentation emphasizes setting up an analysis workstation, analyzing malware behavior on networks and systems, reverse engineering code to understand malware functionality, and using virtual environments and tools safely to explore malware without risking real systems. It provides examples of real malware like Zeus to illustrate analysis concepts and techniques.
More Related Content
Similar to Intro2 malwareanalysisshort
Intro2 malwareanalysisshort
- 1. Security and Privacy Track Session 1
- 2. Introduction to Malware Analysis Vincent = Big O
- 3. What do theyhave in common? Lindsay Lohan Paris Hilton Snooki Charlie Sheen
- 4.
- 5. Albert Gonzales Hacked WirelessNetwork TJ Maxx 90 Million Credit Cards 20 Years in Jail
- 6.
- 8.
- 9. Bad Guys Motivated bymoney New school bad guys are after your electronic wallet Take over payment systems Take over the world Just like Doctor Evil
- 11. About Me Work atCapilano University Hack wet paper bags for a living I live in Vancouver I commute by bike I love 80’s music I love Backtrack4
- 14. I love my mac
- 16. My Reading List NIST WindowsForensics Analysis Reverse Engineering The Rootkit Arsenal Security Power Tools Google Youtube DFWS
- 17. My Favorite HackerCons DEFCON CanSecWest SecTor Blackhat CCC
- 18. Click Happy! and proud of it.
- 19.
- 20. What is MalwareAnalysis? Like being in science class in high school For example studying a worm Used microscope Draw picture or diagram of worm Observed worm before dissection
- 21.
- 22. Purpose Tapas Small taste ofeverything For malware analysis
- 23.
- 24. Malware Short for maliciousprogram Program designed to alter the flow of the program Designed with malicious intent Gain access to systems Used to gather information, usually without permission of owner
- 26. When I wasyounger… Used to deliver malware via floppy disks My favorite piece of malware was Sub7
- 27.
- 28. Symantec Internet Security Threat Report Released April 2011 For the year of 2010 Pdf download Outlines trends for malware, virus and worms
- 29. How do youget infected? Drive by Download Phishing scams Malicious Email attachments Bogus Downloads SQL Injected Websites
- 30.
- 31. Lisa Moon Visited CapilanoUniversity Over 5 Million sites infected SQL injection php webpages Redirected to malware sites
- 32. Fake AV Java Applet ActiveX EXE download
- 36.
- 37.
- 38. Zeus The most notoriousand widely-spread information stealing Trojans in existence Targets financial data theft Lead to the loss of millions worldwide
- 39. Crimeware Toolkit Zeus isa toolkit that provides a malware creator all of the tools required to build and administer a botnet Zeus tools are primarily designed for stealing banking information Zeus can easily be used for other types of data or identity theft
- 40. Controllers of ZBOT Capture(banking) credentials Remote control Keystroke logging Screen capture Proxy services Spamming
- 41. Zeus Builder This pageis where you create your bot executables Once created, you are responsible for distribution Go find some victims
- 42. Zeus Configuration The botneeds a configuration to tell it which address to send all the stolen data What’s the use of misconfiguring a botnet that can’t send you stolen data?
- 43.
- 45. Communications Communications pass betweenthe bots and one or more servers Command and Control Server is used to distribute bot file updates
- 46. Communications Data is encryptedwith RC4 encryption A password is used to encrypt all data that is passed through the botnet
- 48.
- 49. Zeus Flow Copy itselfto another location, execute the copy, delete the original Lowers browser security settings by changing IE registry entries Injects code into other processes, main process exits
- 50. Zeus - Flow Injectedcode hooks APIs in each process Steals several different type of credential found on the system
- 51. Zeus - Flow Downloadsconfig file and processes it Uses API hooks to steal data Sends data back to C&C
- 52.
- 53. Typical Theft Attackers stealcredentials Set up bogus employee/vendor accounts Accounts are actually “mules” Transfers typically kept under $10K
- 54.
- 55.
- 56. Finding Mules Recruited jobwebsites Receive instructions via website Process Payments Laundry via purchases Write proper phishing emails
- 57. Zeus characteristics Continuously changing,software gets routinely updated Strong encryption used in program of various functions to hide secrets Software uses packers and unpackers Anti-virus evasion techniques used
- 58.
- 61. Kung Fu Skillz Codebreaking Puzzle solving Programming Logical analysis
- 62. Kung Fu Build analysisworkstation Behavior and Code Analysis Reverse Engineer Virus Total
- 63. Click Happy Fun( ) Fundamental aspects of malware analysis Setup an inexpensive and flexible laboratory Use lab for exploring characteristics of real-world malware
- 64. Build Workstation Install BaseOS Install vmware Install victim OS Install monitoring tools
- 65. Build Workstation Install BaseOS Install vmware Install victim OS Install monitoring tools
- 67. Build Workstation Install BaseOS Install vmware Install victim OS Install monitoring tools
- 69. Build Workstation Install BaseOS Install vmware Install Victim OS Install monitoring tools
- 70. Build Workstation Install BaseOS Install vmware Install victim OS Install monitoring tools
- 71. Tools PSTools from SysInternals IDAPro Wireshark Anti-virus
- 72. Other Tools Fake DNSand shellcode2exe LordPE, and PEiD Malzilla, and SpiderMonkey Firefox, No Script, BurpSuite Honeyd, NetCat, curl, wget, Volatility Framework and plug-ins such as malfind2 FTK Imager
- 73. Kung Fu Build analysisworkstation Behavior and Code Analysis Reverse Engineer Virus Total
- 74.
- 75. Getting evidence Gathering electronicevidence Evidence process Access Data FTK – Used to solve Lacie Peterson Case
- 77.
- 78. Timeline Phishing – ZeroDay Attack Backdoor installed Lateral Movement Data Gathering Exfiltrate
- 79. How do youknow you have a virus or malware?
- 80. You can relyon… Your anti-virus vendor Web or malware gateway Network analysis tools
- 81. Rootkit Revealer Rootkit detectionutility Lists Registry and file system API discrepancies Helps indicate the presence of a user-mode or kernel-mode rootkits
- 82. Behavior and Code Analysis Two approaches
- 83. Answer these questions! Processcount User ID's Loaded Modules Files Registry Keys
- 84. Answer this! DLL Used APIhooked Memory Space Used Network Connections Services Used Sockets Used
- 85.
- 86. Temporal Reconstruction Forensic analysisto reconstruct events surrounding a hacking incident or malware infection Dead machine and Live System Analysis AKA = Building a Timeline NOTE : Live Analysis means data is volatile
- 87. MACtime forensic tool in your digital detective toolkit Unix and Linux mtime, atime, and ctime Windows LastWriteTime, LastAccessTime, and CreationTime
- 88.
- 89. Timeline Analysis File systemmetadata Event Log entries Data from the Registry User's web browser history Timestamps Network Statistics Logs
- 90. Timestamps Creation Date Last ModifiedDate Last Accessed Date Last Modified Date for the file's Master File Table (MFT) entry
- 91. File Carving Tool forrecovering files and fragments of files when directory entries are corrupt or missing For example – listing directory of pictures Pictures are all deleted in the catalogue File Carving allows investigator to recover pictures without directory listings
- 92.
- 93.
- 97. Hiding Process Backtrack4 LinuxDistribution Rooted box with Metasploit Migrated process via meterpreter script
- 101.
- 102.
- 103. Volatility Digital Forensics Utility Scriptused to walk memory dumps Rebuild running processes Rebuild executables Malfind plug-in finds suspicious files in memory
- 105. Malicious process hidden inPID 4968
- 106. VAD Walk identifies offsets
- 107. Disassembly of offsets
- 108. VAD Walk Virtual AddressDescriptor (VAD) tree structure in Windows memory dumps Method to locate and parse the structure of physical memory Method walks the tree for the “hacked” process
- 109. Using Foremost toget EXE
- 111.
- 112. Using Wireshark Capture packson network of malware contacting Zeus Command and Control Behavior based analysis of malware
- 113. Analysis with NetworkMiner Need pcap file Need download NetworkMiner Need search criteria
- 114.
- 115. Click Happy –Infect your system Set up your process viewers Snapshot your registry with Regshot Configure FakeDNS Start Wireshark Double Click that Executable Intercept system and network-level activities in the analysis lab
- 116. NOTE MAKE SUREYOU DON’T CONNECT TO PROD
- 117. Kung Fu Build analysisworkstation Behavior and Code Analysis Reverse Engineer Virus Total
- 118. What is reverse engineering?
- 119. Reverse engineering isthe process of analyzing a subject to create representations of the system at a higher level of abstraction
- 120. Understanding 1 and0’s Software person programs in language Program gets compiled 1’s and 0’s get “translated” from human readable code to machine instruction Reverse Engineering attempts to take machine instruction and create human readable code
- 121. Compiling Source Code Source Code Compiler Object File
- 122. Object File DLL DLL Linker
- 123.
- 124. Example Assembly MOV AX,47104 MOV DS, AX MOV [3998], 36 INT 32 Each line is one CPU-level instruction
- 125. Example Assembly MOV AX,47104 MOV DS, AX MOV [3998], 36 INT 32 Tells the computer to copy the number 47104 into the location AX
- 126.
- 127. Example Human Readable #include<stdio.h> int main() { printf( “Click Happy.n" ); getchar(); return 0; }
- 128. Purpose of R.E. Manuallyfollow flow of program visually using graphs Manually follow flow of program reading the code Execute code with breakpoints to control the flow of the program during runtime Look for hints or clues to origin, signatures, or programming style Look for characteristics of program
- 129. Reverse-Engineering Benefits Sophisticatedmalware protects itself from discovery and analysis Malware will have passwords, backdoor, and secret methods to hide and protect information Allows analyst to discover great detail on the operations and flow control of the program
- 130. Wouldn’t it benice to have the login and password to the Command and Control Server of a BotNet?
- 131. Manual unpacking ofprotected malicious Windows executables
- 132. Understand anti-analysis mechanisms builtinto malware
- 133. Analyzing protected malicious browser scripts written in JavaScript and VBScript
- 134. Other Benefits ofR.E. Performing static and dynamic code analysis of malicious Windows executables Step through code using debuggers like OllyDbg or SoftICE
- 135. OllyDbg 32-bit assembler leveldebugger Binary code analysis where source is unavailable
- 136. Using OllyDbg Drag executableonto OllyDbg “Step into” each instruction until something fun happens In the register section you can observe what is being run in memory
- 137. Reverse Engineering Potentially givesyou the “why” of the behavior Insight into the inner workings of the program
- 138. BinText Searches Binary orExecutable for all Text Outputs “strings” Provides insight to structure or parts of the program
- 139. Searching strings Analyzing malwarewith IDA Pro and strings
- 140. Kung Fu Build analysisworkstation Behavior and Code Analysis Reverse Engineer Virus Total
- 141.
- 143.
- 145.
- 146.
- 147. APT? Advanced Persistent Threat Threat,such as a foreign nation state government, with both the capability and the intent to persistently and effectively target a specific entity
- 148. Coordinated human involvement NOTmindless and automated piece of code Specific objective Skilled and motivated Organized and well funded
- 154. Photo Credits =Internet
- 155. Thank you! </end>
- 156.
- 157. What are thetwo types of malware analysis?
- 158.
- 159.
- 160. Advanced Persistent Threat
- 161. What is reverseengineering?
- 162. Reverse engineering isthe process of analyzing a subject system to create representations of the system at a higher level of abstraction
- 163. How many PC’sdeployed worldwide?
- 164.
- 165. How many smartphones? What’sthe future market?
- 166. 5 Billion
- 167. What does hackingget you?
- 168.
- 169. Place to stay.3 meals.
- 170.
- 171.
- 172.