Comprehensive Malware Analysis Techniques

Slide Note
Embed
Share

This detailed guide covers basic static techniques, malware analysis in virtual machines, and basic dynamic analysis. It includes information on static analysis, such as examining payloads without execution, file signatures, and signatures generated via analysis. Additionally, it delves into counter-measures used by malware, such as obfuscation, packing, polymorphism, and metamorphism. The chapter also discusses the challenges in signature coverage and cloud-based antivirus solutions.

kerschner_l
kerschner_l Follow

Uploaded on Sep 12, 2024 | 0 Views

Download Presentation

Please find below an Image/Link to download the presentation.

The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.

E N D

Presentation Transcript

  1. Part 1: Basic Analysis Chapter 1: Basic Static Techniques Chapter 2: Malware Analysis in Virtual Machines Chapter 3: Basic Dynamic Analysis

  2. Chapter 1: Basic Static Techniques

  3. Static analysis Examine payload without executing it to determine function and maliciousness Done via scanning content

  4. File signatures Common code or data used across malware instances e.g. embedded URL strings, decryptor code Examples Strings search on metadata, errors, constants Regular expression searches Hashing (e.g. MD5, SHA)

  5. Signatures generated via analysis Artifacts revealed by binary Tools for dumping linked libraries Dependency Walker, PEView, PEBrowse, PE Explorer, ldd Look for common shared libraries (e.g. kernel32.dll, User32.dll, libc.so, etc) Disassemblers

  6. But Astronomical growth in signatures Coverage by a single tool is difficult Cloud-based anti-virus http://www.virustotal.com Bought by Google But, public service that allows attacker to know when their malware has been uploaded and identified! Can use private malware sandbox analysis (VMRay)

  7. Malware counter-measures Obfuscation Code execution is hidden by author to make static analysis difficult Packing Code compressed and encrypted to completely thwart static analysis (Figure 1-4) Code to unpack binaries is common, however Some can be identified (PEiD) Polymorphism and metamorphism Code transformed into equivalent, but different form to thwart static signatures Example: Mimikatz (Metasploit module to do weaponized credential theft on Windows) From 54/54 (100% detection) to 4/54 when replacing mimikatz with kitikatz and recompiling AV with signatures is now completely dead

  8. Chapter 2: Malware Analysis on VMs Chapter 3: Basic Dynamic Analysis

  9. Malware and VMs Most malware must be executed in order to analyze them Requires a safe environment VirtualBox, VMware Host-only networking to monitor network traffic Snapshots and roll-back Record and replay execution

  10. Sandboxes Simpler alternative to VMs Behavior isolation and coarse-grained tracking of malware execution File system activity Registry activity Network activity Examples: GFI Sandbox, Norman SandBox Always use a sandbox or VM to analyze malware

  11. Dont be like

  12. But, can be subtle FireEye anti-virus (12/2015) Static analysis of Java byte-code via a Java decompiler (JODE) so did not run in a VM But, did not realize decompiler executed byte code as well Instant remote code execution AV now *worse* than no AV

  13. Monitoring execution Procmon (Sysmon) www.sysinternals.com Combines process, file, and registry monitoring to track execution behavior Spits out XML on events, allows one to reconstruct process tree Prochacker (http://processhacker.sourceforge.net/) Process (memory) monitoring Process explorer Verify running process against the disk executable image Determine if malicious documents are launching new processes Regshot Flag changes in registry

  14. Monitoring execution ApateDNS Capture DNS requests and modify replies More comprehensive follow-on tool.. Flare-NG https://github.com/fireeye/flare-fakenet-ng/releases Netcat Proxying and emulating connections Wireshark Packet capturing tool INetSim Simulate common Internet services

  15. Tools in action See p. 57 in text (msts.exe) Setup tools (process/network/registry monitoring, setup VMs, server emulation) Fig. 3-12 Contacts web site (the textbook's) ApateDNS Creates new file (winhlp2.exe) procmon Modifies registry to autorun regshot Creates a mutex to ensure only a single execution Process Explorer Contacts a server over port 443 (https), but does not speak SSL INetSim Speaks a custom protocol Wireshark

  16. In-class exercises Lab 1-1, Lab 1-2 Lab 3-2, Lab 3-4

Related


Analysis of Mixed-Mode Malware and Malware Analysis Tools

Analysis of Mixed-Mode Malware and Malware Analysis Tools

mac_h
MapReduce Method for Malware Detection in Parallel Systems

MapReduce Method for Malware Detection in Parallel Systems

zaer318
Evaluating Android Anti-malware Against Transformation Attacks

Evaluating Android Anti-malware Against Transformation Attacks

nady
Understanding Malware: Types, Usage, and Protection

Understanding Malware: Types, Usage, and Protection

zipporah
Understanding Malware: Types, Symptoms, and Countermeasures

Understanding Malware: Types, Symptoms, and Countermeasures

kennade
Introduction to Malware Reverse Engineering

Introduction to Malware Reverse Engineering

joel_708
Understanding Malware: Definitions and Types

Understanding Malware: Definitions and Types

azel963
Understanding Malware and Computer Security

Understanding Malware and Computer Security

cwirk
Exploring SMT Solvers for Malware Unpacking

Exploring SMT Solvers for Malware Unpacking

ray_904
Understanding Malware Analysis Using Cuckoo Sandbox

Understanding Malware Analysis Using Cuckoo Sandbox

ash_g
Emerging Malware Threats in the COVID-19 Era

Emerging Malware Threats in the COVID-19 Era

jeer686
Understanding Malware: Types, Risks, and Prevention

Understanding Malware: Types, Risks, and Prevention

andi
Context-Aware Malware Detection Using GANs in Signal Systems

Context-Aware Malware Detection Using GANs in Signal Systems

sart_an
Understanding Malware: Types, Risks, and Prevention

Understanding Malware: Types, Risks, and Prevention

lkmy
Understanding Computer System Security Threats and Malware Types at Eshan College of Engineering

Understanding Computer System Security Threats and Malware Types at Eshan College of Engineering

balbuena_c
Understanding DeepLocker Malware and AI-Embedded Attacks

Understanding DeepLocker Malware and AI-Embedded Attacks

enapl
Malware Dynamic Analysis Part 6 Overview

Malware Dynamic Analysis Part 6 Overview

couillard_n
Analyzing Android Applications for Malware Detection

Analyzing Android Applications for Malware Detection

mare117
Understanding Malware Analysis with OllyDbg: A Practical Approach

Understanding Malware Analysis with OllyDbg: A Practical Approach

mirren
Understanding Malware: Types, Risks, and Removal Methods

Understanding Malware: Types, Risks, and Removal Methods

pron
Understanding Malicious Software and Its Impact on Computer Systems

Understanding Malicious Software and Its Impact on Computer Systems

bess_wyn
Understanding Malware Execution and DLLs in IDA

Understanding Malware Execution and DLLs in IDA

pent_vi
Understanding Malicious Software in Computer Security

Understanding Malicious Software in Computer Security

kendallw
Understanding Malicious Software: Classification and Payload Actions

Understanding Malicious Software: Classification and Payload Actions

rya_kav

More Related Content