Open Source Malware Lab
•Download as PPTX, PDF•
8 likes•1,798 views
The landscape of open source malware analysis tools improves every day. A malware analysis lab can be thought of as a set of entry points into a tool chain. The main entry points are a file, a URL, a network traffic capture, and a memory image. This talk is an examination of the major open source tools that satisfy the analysis requirements for each of these entry points. Each tool’s output can potentially feed into another tool for further analysis. The linking of one tool to the next in a tool chain allows one to build a comprehensive automated malware analysis lab using open source software. For file analysis, the three major versions of Cuckoo Sandbox will be examined. To analyze a potentially malicious URL, the low-interaction honeyclient, Thug, will be covered. Next, if one has a network capture (PCAP) to analyze, the Bro Network Security Monitor is a great option, and will be covered. Finally, if the analysis target is a memory image, the Volatility Framework will be examined. Each of the inputs and outputs of the tools will be reviewed to expose ways that they can be chained together for the purpose of automation.
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Open Source Malware Lab
Similar to Open Source Malware Lab (20)
More from ThreatConnect
More from ThreatConnect (12)
Recently uploaded
Recently uploaded (20)
Open Source Malware Lab
- 1. 1@ThreatConnect Open Source Malware Lab © 2016 ThreatConnect, Inc. All Rights Reserved
- 2. 2@ThreatConnect Director of Research Innovation Research Team ThreatConnect, Inc. © 2016 ThreatConnect, Inc. All Rights Reserved
- 3. 3@ThreatConnect Why Do I Need A Malware Analysis Lab? • Malware Research • Automated Malware Analysis (AMA) • First two of four major stages • AMA can include second stage • Enhanced Threat Intelligence • Analysis of malware in your enterprise • Stage of malware hunting process • Network Defense • Network Traffic • Inbound Email • Host Intrusion Detection System • Fun!!! https://zeltser.com/mastering-4-stages-of-malware-analysis/ © 2016 ThreatConnect, Inc. All Rights Reserved
- 4. 4@ThreatConnect Malware Analysis Process Entry Points File URL PCAP Memory Image © 2016 ThreatConnect, Inc. All Rights Reserved
- 5. 5@ThreatConnect Cuckoo Sandbox Thug Bro Volatility Open Source Malware Analysis Tools © 2016 ThreatConnect, Inc. All Rights Reserved
- 6. 6@ThreatConnect Cuckoo Sandbox Static and Dynamic File Analysis © 2016 ThreatConnect, Inc. All Rights Reserved
- 7. 7@ThreatConnect Sandbox • A controlled, safe environment • Leverages • Virtual machines • Bare metal computers • Running malware • Observing its behavior • Dynamic malware analysis • May also perform static malware analysis © 2016 ThreatConnect, Inc. All Rights Reserved
- 8. 8@ThreatConnect More Than Just Dynamic Analysis © 2016 ThreatConnect, Inc. All Rights Reserved TrendMicro: OSX_KeRanger.A ESET-NOD32: OSX/Filecoder.KeRanger.A Kaspersky: UDS:DangerousObject.Multi.Generic $Info: This file is packed with the UPX executable packer http://upx.sf.net $ $Id: UPX 3.91 Copyright (C) 1996-2013 the UPX Team. All Rights Reserved. $ Strings AV Detections
- 9. 9@ThreatConnect More Than Just Dynamic Analysis © 2016 ThreatConnect, Inc. All Rights Reserved TrendMicro: OSX_KeRanger.A ESET-NOD32: OSX/Filecoder.KeRanger.A Kaspersky: UDS:DangerousObject.Multi.Generic $Info: This file is packed with the UPX executable packer http://upx.sf.net $ $Id: UPX 3.91 Copyright (C) 1996-2013 the UPX Team. All Rights Reserved. $ Strings AV Detections
- 10. 10@ThreatConnect More Than Just Dynamic Analysis © 2016 ThreatConnect, Inc. All Rights Reserved TrendMicro: OSX_KeRanger.A ESET-NOD32: OSX/Filecoder.KeRanger.A Kaspersky: UDS:DangerousObject.Multi.Generic $Info: This file is packed with the UPX executable packer http://upx.sf.net $ $Id: UPX 3.91 Copyright (C) 1996-2013 the UPX Team. All Rights Reserved. $ Strings AV Detections
- 11. 11@ThreatConnect More Than Just Dynamic Analysis © 2016 ThreatConnect, Inc. All Rights Reserved TrendMicro: OSX_KeRanger.A ESET-NOD32: OSX/Filecoder.KeRanger.A Kaspersky: UDS:DangerousObject.Multi.Generic $Info: This file is packed with the UPX executable packer http://upx.sf.net $ $Id: UPX 3.91 Copyright (C) 1996-2013 the UPX Team. All Rights Reserved. $ Strings AV Detections
- 12. 12@ThreatConnect More Than Just Dynamic Analysis © 2016 ThreatConnect, Inc. All Rights Reserved data RT_VERSION 3519388073965d5b6bae77135c36786f6f8e6882099a88504fba d3ed9b9c9687 99 files found Name Addr Ent MD5 .rsrc 532480 3.59 7ce8cbef10f26dfee328a35f2c724cd5 52 files found Sections Resources Timestamp: 2016-03-07 09:41:34 First Seen: 2016-03-07 09:42:47 95c231bb, web, RU File Metadata
- 13. 13@ThreatConnect More Than Just Dynamic Analysis © 2016 ThreatConnect, Inc. All Rights Reserved data RT_VERSION 3519388073965d5b6bae77135c36786f6f8e6882099a88504fba d3ed9b9c9687 99 files found Name Addr Ent MD5 .rsrc 532480 3.59 7ce8cbef10f26dfee328a35f2c724cd5 52 files found Sections Resources Timestamp: 2016-03-07 09:41:34 First Seen: 2016-03-07 09:42:47 95c231bb, web, RU File Metadata
- 14. 14@ThreatConnect More Than Just Dynamic Analysis © 2016 ThreatConnect, Inc. All Rights Reserved data RT_VERSION 3519388073965d5b6bae77135c36786f6f8e6882099a88504fba d3ed9b9c9687 99 files found Name Addr Ent MD5 .rsrc 532480 3.59 7ce8cbef10f26dfee328a35f2c724cd5 52 files found Sections Resources Timestamp: 2016-03-07 09:41:34 First Seen: 2016-03-07 09:42:47 95c231bb, web, RU File Metadata
- 15. 15@ThreatConnect More Than Just Dynamic Analysis © 2016 ThreatConnect, Inc. All Rights Reserved data RT_VERSION 3519388073965d5b6bae77135c36786f6f8e6882099a88504fba d3ed9b9c9687 99 files found Name Addr Ent MD5 .rsrc 532480 3.59 7ce8cbef10f26dfee328a35f2c724cd5 52 files found Sections Resources Timestamp: 2016-03-07 09:41:34 First Seen: 2016-03-07 09:42:47 95c231bb, web, RU File Metadata
- 16. 16@ThreatConnect More Than Just Dynamic Analysis © 2016 ThreatConnect, Inc. All Rights Reserved data RT_VERSION 3519388073965d5b6bae77135c36786f6f8e6882099a88504fba d3ed9b9c9687 99 files found Name Addr Ent MD5 .rsrc 532480 3.59 7ce8cbef10f26dfee328a35f2c724cd5 52 files found Sections Resources Timestamp: 2016-03-07 09:41:34 First Seen: 2016-03-07 09:42:47 95c231bb, web, RU File Metadata
- 17. 17@ThreatConnect More Than Just Dynamic Analysis © 2016 ThreatConnect, Inc. All Rights Reserved data RT_VERSION 3519388073965d5b6bae77135c36786f6f8e6882099a88504fba d3ed9b9c9687 99 files found Name Addr Ent MD5 .rsrc 532480 3.59 7ce8cbef10f26dfee328a35f2c724cd5 52 files found Sections Resources Timestamp: 2016-03-07 09:41:34 First Seen: 2016-03-07 09:42:47 95c231bb, web, RU File Metadata
- 18. 18@ThreatConnect More Than Just Dynamic Analysis © 2016 ThreatConnect, Inc. All Rights Reserved data RT_VERSION 3519388073965d5b6bae77135c36786f6f8e6882099a88504fba d3ed9b9c9687 99 files found Name Addr Ent MD5 .rsrc 532480 3.59 7ce8cbef10f26dfee328a35f2c724cd5 52 files found Sections Resources Timestamp: 2016-03-07 09:41:34 First Seen: 2016-03-07 09:42:47 95c231bb, web, RU File Metadata
- 19. 19@ThreatConnect More Than Just Dynamic Analysis © 2016 ThreatConnect, Inc. All Rights Reserved data RT_VERSION 3519388073965d5b6bae77135c36786f6f8e6882099a88504fba d3ed9b9c9687 99 files found Name Addr Ent MD5 .rsrc 532480 3.59 7ce8cbef10f26dfee328a35f2c724cd5 52 files found Sections Resources Timestamp: 2016-03-07 09:41:34 First Seen: 2016-03-07 09:42:47 95c231bb, web, RU File Metadata
- 20. 20@ThreatConnect Cuckoo Sandbox Flavors © 2016 ThreatConnect, Inc. All Rights Reserved Plain Vanilla Version 1.2 (Stable) Cuckoo Modified (brad-accuvant / spender-sandbox) Next Generation Version 2.0 RC1
- 21. 21@ThreatConnect Cuckoo Modified • Normalization of file and registry paths • 64bit analysis • Service monitoring • Extended API • Tor for outbound network connections • Malheur integration © 2016 ThreatConnect, Inc. All Rights Reserved
- 22. 22@ThreatConnect Normalization - Why this is Great! • Not normalized •C:Documents and SettingsDumdumApplication DatabonzoAIDVFP.jpg •C:UsersDumdumAppDatabonzoAIDVFP.jpg • Normalized •%APPDATA%bonzoAIDVFP.jpg © 2016 ThreatConnect, Inc. All Rights Reserved
- 23. 23@ThreatConnect Cuckoo Next Generation • Support for: • MacOS X • Linux • Android © 2016 ThreatConnect, Inc. All Rights Reserved • Integrations • Suricata • Snort • Moloch • SSL decryption • VPN support • 64-bit analysis • Fun, fun, fun
- 24. 24@ThreatConnect What if the Malware is VM or Sandbox Aware? • Pafish (Paranoid Fish) • Uses malware’s anti-analysis techniques • Shows successful and unsuccessful techniques • Pinpoint ways to improve sandbox • VMCloak • Automated generation of Windows VM images • Ready for use in Cuckoo • Obfuscates VM to prevent anti-analysis © 2016 ThreatConnect, Inc. All Rights Reserved
- 25. 25@ThreatConnect Cuckoo Output • HTML Report • JSON Report • MongoDB Output • Dropped Files • PCAP • Memory Image • Visited URLs © 2016 ThreatConnect, Inc. All Rights Reserved
- 26. 26@ThreatConnect Thug Low-Interaction Honeyclient © 2016 ThreatConnect, Inc. All Rights Reserved
- 27. 27@ThreatConnect What is a Low-Interaction Honeyclient? • Pretends to be a browser • Trigger a drive-by download • Capture its payload © 2016 ThreatConnect, Inc. All Rights Reserved
- 28. 28@ThreatConnect Wolf in Sheep’s Clothing • User agent can change • Windows, Mac, Linux, Android, iOS • Limitless possibilities • http://www.useragentstring.com/pages/ useragentstring.php • http://www.browser-info.net/useragents • Simulates vulnerable plugins with configurable versions • Flash • Java • Acrobat Reader (PDF) © 2016 ThreatConnect, Inc. All Rights Reserved
- 29. 29@ThreatConnect Available User Agents © 2016 ThreatConnect, Inc. All Rights Reserved
- 30. 30@ThreatConnect Thug Output • Payload Files • Other Content Files • Visited URLs • MongoDB Output • Elasticsearch Output • HPFeeds • MAEC • Native Report Format © 2016 ThreatConnect, Inc. All Rights Reserved
- 31. 31@ThreatConnect Bro Network Analysis Framework © 2016 ThreatConnect, Inc. All Rights Reserved
- 32. 32@ThreatConnect What is Bro? • Network Security Monitoring (NSM) Framework • Processes • Live Packet Capture • Recorded Packet Capture (PCAP) • Series of scripts • Output Bro logs • Packaged with a large group of scripts • Rich community of open source scripts • Write your own Bro script for specific needs © 2016 ThreatConnect, Inc. All Rights Reserved
- 33. 33@ThreatConnect Bro in Action © 2016 ThreatConnect, Inc. All Rights Reserved • Analysis Target: tue_schedule.doc_7387.doc • PCAP Source: https://www.hybrid-analysis.com/ • SHA1: bb45bca4ccc0dd6a0b3a2c6001165f72fbd2cb6e • What can we learn from PCAP only?
- 34. 34@ThreatConnect conn.log $ cat conn.log | bro-cut -c uid id.resp_h id.resp_p proto service | sed -e 's/#fields//g' | grep -v '#' | column -t © 2016 ThreatConnect, Inc. All Rights Reserved
- 35. 35@ThreatConnect conn.log $ cat conn.log | bro-cut -c uid id.resp_h id.resp_p proto service | sed -e 's/#fields//g' | grep -v '#' | column -t © 2016 ThreatConnect, Inc. All Rights Reserved
- 36. 36@ThreatConnect conn.log $ cat conn.log | bro-cut -c uid id.resp_h id.resp_p proto service | sed -e 's/#fields//g' | grep -v '#' | column -t © 2016 ThreatConnect, Inc. All Rights Reserved
- 37. 37@ThreatConnect conn.log $ cat conn.log | bro-cut -c uid id.resp_h id.resp_p proto service | sed -e 's/#fields//g' | grep -v '#' | column -t © 2016 ThreatConnect, Inc. All Rights Reserved
- 38. 38@ThreatConnect conn.log $ cat conn.log | bro-cut -c uid id.resp_h id.resp_p proto service | sed -e 's/#fields//g' | grep -v '#' | column -t © 2016 ThreatConnect, Inc. All Rights Reserved
- 39. 39@ThreatConnect dns.log $ cat dns.log | bro-cut -c query qtype_name answers rcode_name | grep 'NOERROR|fields' | sed -e 's/#fields//g' | column -t © 2016 ThreatConnect, Inc. All Rights Reserved
- 40. 40@ThreatConnect dns.log $ cat dns.log | bro-cut -c query qtype_name answers rcode_name | grep 'NOERROR|fields' | sed -e 's/#fields//g' | column -t © 2016 ThreatConnect, Inc. All Rights Reserved
- 41. 41@ThreatConnect dns.log $ cat dns.log | bro-cut -c query qtype_name answers rcode_name | grep 'NOERROR|fields' | sed -e 's/#fields//g' | column -t © 2016 ThreatConnect, Inc. All Rights Reserved
- 42. 42@ThreatConnect Poor Man’s pDNS © 2016 ThreatConnect, Inc. All Rights Reserved
- 43. 43@ThreatConnect Whois Data © 2016 ThreatConnect, Inc. All Rights Reserved
- 44. 44@ThreatConnect Whois Data © 2016 ThreatConnect, Inc. All Rights Reserved
- 45. 45@ThreatConnect Site Content © 2016 ThreatConnect, Inc. All Rights Reserved
- 46. 46@ThreatConnect Site Content © 2016 ThreatConnect, Inc. All Rights Reserved
- 47. 47@ThreatConnect dns.log $ cat dns.log | bro-cut -c query qtype_name answers rcode_name | grep 'NOERROR|fields' | sed -e 's/#fields//g' | column -t © 2016 ThreatConnect, Inc. All Rights Reserved
- 48. 48@ThreatConnect Poor Man’s pDNS © 2016 ThreatConnect, Inc. All Rights Reserved
- 49. 49@ThreatConnect Whois Data © 2016 ThreatConnect, Inc. All Rights Reserved
- 50. 50@ThreatConnect Whois Data © 2016 ThreatConnect, Inc. All Rights Reserved
- 51. 51@ThreatConnect Poor Man’s Reverse Whois © 2016 ThreatConnect, Inc. All Rights Reserved
- 52. 52@ThreatConnect Site Content © 2016 ThreatConnect, Inc. All Rights Reserved
- 53. 53@ThreatConnect dns.log $ cat dns.log | bro-cut -c query qtype_name answers rcode_name | grep 'NOERROR|fields' | sed -e 's/#fields//g' | column -t © 2016 ThreatConnect, Inc. All Rights Reserved
- 54. 54@ThreatConnect Whois Data © 2016 ThreatConnect, Inc. All Rights Reserved
- 55. 55@ThreatConnect Whois Data © 2016 ThreatConnect, Inc. All Rights Reserved
- 56. 56@ThreatConnect pDNS © 2016 ThreatConnect, Inc. All Rights Reserved
- 57. 57@ThreatConnect http.log $ cat http.log | bro-cut -u -C id.resp_h method host uri status_code resp_fuids resp_mime_types | grep '#fields|200' | sed -e 's/#fields//g' | column -t © 2016 ThreatConnect, Inc. All Rights Reserved
- 58. 58@ThreatConnect http.log $ cat http.log | bro-cut -u -C id.resp_h method host uri status_code resp_fuids resp_mime_types | grep '#fields|200' | sed -e 's/#fields//g' | column -t © 2016 ThreatConnect, Inc. All Rights Reserved
- 59. 59@ThreatConnect© 2016 ThreatConnect, Inc. All Rights Reserved Zapoi (Russian: запой) A term used in Russia and other post-Soviet states to describe alcohol abuse behavior resulting in two or more days of continuous drunkenness. https://en.wikipedia.org/wiki/Zapoy
- 60. 60@ThreatConnect /zapoy/gate.php = Pony © 2016 ThreatConnect, Inc. All Rights Reserved
- 61. 61@ThreatConnect http.log $ cat http.log | bro-cut -u -C id.resp_h method host uri status_code resp_fuids resp_mime_types | grep '#fields|200' | sed -e 's/#fields//g' | column -t © 2016 ThreatConnect, Inc. All Rights Reserved
- 62. 62@ThreatConnect /xdaovcny/index.php = Nymaim © 2016 ThreatConnect, Inc. All Rights Reserved
- 63. 63@ThreatConnect http.log $ cat http.log | bro-cut -u -C id.resp_h method host uri status_code resp_fuids resp_mime_types | grep '#fields|200' | sed -e 's/#fields//g' | column -t © 2016 ThreatConnect, Inc. All Rights Reserved
- 64. 64@ThreatConnect pe.log $ cat pe.log | bro-cut -c id machine compile_ts subsystem is_exe section_names | sed -e 's/#fields//g' | grep -v '#' | column -t © 2016 ThreatConnect, Inc. All Rights Reserved
- 65. 65@ThreatConnect files.log $ cat files.log | bro-cut -c fuid filename total_bytes md5 sha1 sha256 | grep 'F8Ksgsir0wLKqA4e9||F0XaRJ2XvH5Epscnqj|#fields' | sed -e 's/#fields//g' | column -t | cut -d " " -f 2- | column -t © 2016 ThreatConnect, Inc. All Rights Reserved
- 66. 66@ThreatConnect MAN1 Adversary Group © 2016 ThreatConnect, Inc. All Rights Reserved http://www.threatgeek.com/2016/07/tracking-man1-crypter-actor.html
- 67. 67@ThreatConnect What Can We Learn From PCAP Only? • Adversary Likely Russophone • Office Document generating network traffic • Multi-stage malware • One payload is Pony • One payload is Nymaim • Nymaim has • Dedicated infrastructure •Rogue DNS • Dropper uses compromised Drupal websites • Adversary is MAN1 © 2016 ThreatConnect, Inc. All Rights Reserved
- 68. 68@ThreatConnect Collected Lots of Indicators © 2016 ThreatConnect, Inc. All Rights Reserved
- 69. 69@ThreatConnect My local.bro © 2016 ThreatConnect, Inc. All Rights Reserved
- 70. 70@ThreatConnect cuddlesome.exe = Ruckguv © 2016 ThreatConnect, Inc. All Rights Reserved
- 71. 71@ThreatConnect Bro Output • Important Logs • conn.log • dns.log • http.log • pe.log • file.log • Extracted Files • Alternative JSON Output for Elasticsearch © 2016 ThreatConnect, Inc. All Rights Reserved
- 72. 72@ThreatConnect Volatility Memory Analysis Framework © 2016 ThreatConnect, Inc. All Rights Reserved
- 73. 73@ThreatConnect What is the Volatility Framework? • Extracts artifacts from samples of volatile memory • An amazing view into what is happening in memory while a malware sample is running © 2016 ThreatConnect, Inc. All Rights Reserved
- 74. 74@ThreatConnect Operating System Support © 2016 ThreatConnect, Inc. All Rights Reserved
- 75. 75@ThreatConnect Volatility in Action • Analysis Target: b.exe • Sample Source: https://www.hybrid-analysis.com/ • SHA1: 5149b40858c575238f1cbfcd32dd78a30bc87742 • What can we learn from memory analysis? © 2016 ThreatConnect, Inc. All Rights Reserved
- 76. 76@ThreatConnect Preparing Your Memory ImageConvert ELF64 image into raw dd-style memory dump • Dump a memory image from running VirtualBox VM • VBoxManage debugvm "Win7x64" dumpvmcore --filename=vbox.img • vol.py -f vbox.img --profile=Win7SP1x64 imagecopy -O copy.raw © 2016 ThreatConnect, Inc. All Rights Reserved
- 77. 77@ThreatConnect pslist & psscan © 2016 ThreatConnect, Inc. All Rights Reserved • psscan shows hidden and terminated processes • pslist shows running processes • pslist before and after running malware sample
- 78. 78@ThreatConnect malfind $ vol.py -f copy.raw --profile=Win7SP1x64 malfind -D . © 2016 ThreatConnect, Inc. All Rights Reserved
- 79. 79@ThreatConnect Malware Found? Avira: TR/Patched.Ren.Gen7 Qihoo-360: HEUR/QVM40.1.Malware.Gen Qihoo-360: HEUR/QVM40.1.Malware.Gen 0x80000 0xa000 © 2016 ThreatConnect, Inc. All Rights Reserved
- 80. 80@ThreatConnect netscan $ vol.py -f copy.raw --profile=Win7SP1x64 netscan | grep explorer © 2016 ThreatConnect, Inc. All Rights Reserved
- 81. 81@ThreatConnect What Can We Learn From Memory Analysis? • Sample uses process injection • Injects explorer.exe • Command and Control IP Address: 216.170.126.105 © 2016 ThreatConnect, Inc. All Rights Reserved
- 82. 82@ThreatConnect Volatility Output • Files extracted from services • Files extracted from injection • DLLs extracted • IP addresses extracted from network connections • URLs extracted from IE history • URLs extracted from malware configuration • Suspicious mutexes © 2016 ThreatConnect, Inc. All Rights Reserved
- 83. 83@ThreatConnect Tying It All Together Conclusion © 2016 ThreatConnect, Inc. All Rights Reserved
- 84. 84@ThreatConnect Cuckoo, Thug, Bro Process © 2016 ThreatConnect, Inc. All Rights Reserved
- 85. 85@ThreatConnect Volatility, Thug, Cuckoo Process © 2016 ThreatConnect, Inc. All Rights Reserved
- 86. 86@ThreatConnect Orchestration and Automation • Use a message queue • Redis • Rabbit MQ • ZeroMQ <- Preferred • Use NGINX for file transfer under message queue • Keep all output in Elasticsearch • Cuckoo needs to be cuckoo-modified or write your own report plugin • Thug uses ES natively • Bro can export logs in JSON format • Volatility can export logs in JSON format • Glue everything together with Python3 © 2016 ThreatConnect, Inc. All Rights Reserved
- 87. 87@ThreatConnect Questions? © 2016 ThreatConnect, Inc. All Rights Reserved www.ThreatConnect.com/blog @MalwareUtkonos @ThreatConnect