diy malware analysis with minibis
play

DIY Malware Analysis with Minibis Christian Wojner, L. Aaron Kaplan - PowerPoint PPT Presentation

Mar 06, 2024 •433 likes •898 views

DIY Malware Analysis with Minibis Christian Wojner, L. Aaron Kaplan ({wojner,kaplan}@cert.at) 2010/11/22 1 * who knows minibis * who uses minibis? Overview 1. Overview 2. About CERT.at: our tools

  1. DIY Malware Analysis with Minibis Christian Wojner, L. Aaron Kaplan ({wojner,kaplan}@cert.at) 2010/11/22 1 * ¡who ¡knows ¡minibis * ¡who ¡uses ¡minibis?

  2. Overview 1. ¡Overview 2. ¡About ¡CERT.at: ¡our ¡tools ¡and ¡services 3. ¡Minibis 4. ¡Minibis ¡ApplicaKons 5. ¡Future 2010/11/22 {wojner,kaplan}@cert.at

  3. Overview 1. ¡last ¡minute ¡schedule ¡change 2. ¡This ¡talk ¡is ¡a ¡ preview ¡of ¡the ¡Minibis ¡talk ¡at ¡ FIRST2011. 3. ¡Minibis ¡2.1b ¡works, ¡is ¡downloadable ¡for ¡ free ¡and ¡we ¡use ¡it ¡ourselves 2010/11/22 {wojner,kaplan}@cert.at

  4. Overview CERT.at 2010/11/22 {wojner,kaplan}@cert.at

  5. Overview CERT.at • naKonal ¡CERT ¡for ¡Austria ¡since ¡2008 • cooperaKon ¡with ¡chancellory ¡of ¡Austria: ¡ GovCERT.gv.at • “Feuerwehr” ¡(fire ¡brigade) ¡ ¡for ¡the ¡ Internet ¡of ¡Austria • CERT.at ¡is ¡a ¡project ¡of ¡NIC.at ¡(AT ¡registry) 2010/11/22 {wojner,kaplan}@cert.at

  6. Overview CERT.at - Services 2010/11/22 {wojner,kaplan}@cert.at

  7. Overview CERT.at - Services 2010/11/22 {wojner,kaplan}@cert.at

  8. Overview CERT.at - Services 2010/11/22 {wojner,kaplan}@cert.at

  9. Overview CERT.at - Services 2010/11/22 {wojner,kaplan}@cert.at

  10. Overview CERT.at - Services 2010/11/22 {wojner,kaplan}@cert.at

  11. Overview CERT.at - Services • regular ¡trainings ¡(TRANSITs, ¡“IT ¡Security ¡ StammKsch”) • Warning@lists.cert.at ¡ML • Discuss@lists.cert.at ¡ML • Purpose: ¡informaKon ¡hub ¡for ¡IT ¡Security ¡ incidents • We ¡are ¡ not ¡the ¡police 2010/11/22 {wojner,kaplan}@cert.at

  12. Overview CERT.at - Contact 2010/11/22 {wojner,kaplan}@cert.at

  13. DYI mass malware analysis with Minibis 2010/11/22 {wojner,kaplan}@cert.at

  14. Minibis - History 1. ¡Our ¡inspiraKon: ¡ Anubis ¡= ¡“ An alyzing ¡ u nknown ¡ bi naries” 2. ¡we ¡needed ¡some ¡ offline ¡ analysis ¡ capabiliKes 3. ¡License ¡costs/Kme ¡ issue 2010/11/22 {wojner,kaplan}@cert.at

  15. Anubis screenshot (credits: iseclab) credits: ¡iseclab 2010/11/22 {wojner,kaplan}@cert.at

  16. Minibis - Motivation • Problem: ¡malware ¡can ¡check ¡if ¡it ¡runs ¡on ¡the ¡ Anubis ¡server ¡(via ¡IP ¡addr) • hbp://avtracker.info • We ¡run ¡on ¡$IP ¡;-­‑) ¡ • ... ¡or ¡not ¡connected ¡to ¡the ¡network ¡at ¡all • ... ¡or ¡(potenKally) ¡connected ¡to ¡a ¡honeynet • license: ¡ISCL ¡ ¡(~ ¡BSD ¡license) • actually, ¡it ¡was ¡a ¡proof ¡of ¡concept: ¡does ¡malware ¡ check ¡for ¡virtualizaKon? 2010/11/22 {wojner,kaplan}@cert.at

  17. Minibis - Evolution 2010/11/22 {wojner,kaplan}@cert.at

  18. Minibis - Evolution 2010/11/22 {wojner,kaplan}@cert.at

  19. Minibis - Basic Idea 2010/11/22 {wojner,kaplan}@cert.at

  20. Behavorial Analysis Steps 1. ¡Prepare ¡system ¡(virtual ¡machine) ¡with ¡monitoring ¡ tools 2. ¡Transfer ¡sample ¡to ¡virtual ¡machine 3. ¡Start ¡up ¡monitoring ¡tools ¡in ¡the ¡VM 4. ¡Run ¡sample 5. ¡Give ¡sample ¡some ¡Kme ¡to ¡do ¡nasty ¡things 6. ¡Save ¡monitoring ¡logs ¡and ¡transfer ¡them ¡back 7. ¡Analyze ¡logs 8. ¡(Revert ¡VM) 2010/11/22 {wojner,kaplan}@cert.at

  21. Minibis - Architectural Concept 2010/11/22 {wojner,kaplan}@cert.at

  22. Minibis - Architectural Concept (2) 2010/11/22 {wojner,kaplan}@cert.at CPR = controller process researcher CPP = controller process proband

  23. Architectural Concept (3) color legend: tab researcher tab Proband tab sample type postminibis plugins 2010/11/22 {wojner,kaplan}@cert.at

  24. Architectural Concept (3) minibis-gui: for configuration, progress/status view color legend: tab researcher tab Proband tab sample type postminibis plugins 2010/11/22 {wojner,kaplan}@cert.at

  25. Architectural Concept (3) minibis-cpr: “controller process of researcher” color legend: tab researcher tab Proband tab sample type postminibis plugins 2010/11/22 {wojner,kaplan}@cert.at

  26. Architectural Concept (3) minibis-cpp: “controller process of proband” color legend: tab researcher tab Proband tab sample type postminibis plugins 2010/11/22 {wojner,kaplan}@cert.at

  27. Architectural Concept (3) postminibis: log file classification/ interpretation color legend: tab researcher tab Proband tab sample type postminibis plugins 2010/11/22 {wojner,kaplan}@cert.at

  28. Walkthrough - Main screen 2010/11/22 {wojner,kaplan}@cert.at

  29. Walkthrough - Config->General 2010/11/22 {wojner,kaplan}@cert.at

  30. Walkthrough - Config->Researcher 2010/11/22 {wojner,kaplan}@cert.at

  31. Walkthrough - Config->Proband 2010/11/22 {wojner,kaplan}@cert.at

  32. Walkthrough - Config->Sample Types 2010/11/22 {wojner,kaplan}@cert.at

  33. Walkthrough - Config->Sample Types 2010/11/22 {wojner,kaplan}@cert.at

  34. Output directory organization ¡ filename ¡= ¡“$md5++internal_vmid+sample_type++resulmile Result ¡folder ¡(based ¡on ¡config)/ ¡ ¡|-­‑ ¡ YYYY / ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡|-­‑-­‑ ¡ MM / ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡|-­‑ ¡ DD / ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡|-­‑ ¡ HHMISS / ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡|-­‑ ¡ filename 2010/11/22 {wojner,kaplan}@cert.at

  35. postminibis • Analyse ¡results, ¡classify ¡(alert, ¡warning, ¡info ¡level) • extensible ¡via ¡shell ¡scripKng ¡for ¡any ¡log ¡file ¡coming ¡out ¡of ¡ Minibis • toolset ¡for ¡interpretaKon ¡of ¡ result ¡files $ postminibis \ /minibis/2010/11/24/171328/| \ grep ";a;" 2010/11/22 {wojner,kaplan}@cert.at dient zur analyse der ergebnis files und zur klassifikation der alert/warning/info levels Weiters: es ist mittels shell script plugins beliebig erweiterbar fuer beliebie analyse output files von minibis * scriptable * must parse CSV syntax * toolset for interpretation of result files

  36. Typical output of postminibis • d407ebf73d25715050bea07fdbfb76a5;2010/11/24-16:15:27; ;a;Se tting autostart-registry-key "HKLM\SOFTWARE\Microsoft\Windows \CurrentVersion\RunServices\Microsoft Update 32" => ,"SUCCESS","Type: REG_SZ, Length: 24, Data: network.exe " 2010/11/22 {wojner,kaplan}@cert.at

  37. Typical output of postminibis • d407ebf73d25715050bea07fdbfb76a5;2010/11/24-16:15:27; ;a;Se tting autostart-registry-key "HKLM\SOFTWARE\Microsoft\Windows \CurrentVersion\RunServices\Microsoft Update 32" => ,"SUCCESS","Type: REG_SZ, Length: 24, Data: network.exe " 2010/11/22 {wojner,kaplan}@cert.at

  38. Typical output of postminibis • d407ebf73d25715050bea07fdbfb76a5;2010/11/24-16:15:27; ;a;Se tting autostart-registry-key "HKLM\SOFTWARE\Microsoft\Windows \CurrentVersion\RunServices\Microsoft Update 32" => ,"SUCCESS","Type: REG_SZ, Length: 24, Data: network.exe " 2010/11/22 {wojner,kaplan}@cert.at

  39. Typical output of postminibis • d407ebf73d25715050bea07fdbfb76a5;2010/11/24-16:15:27; ;a;Se tting autostart-registry-key "HKLM\SOFTWARE\Microsoft\Windows \CurrentVersion\RunServices\Microsoft Update 32" => ,"SUCCESS","Type: REG_SZ, Length: 24, Data: network.exe " 2010/11/22 {wojner,kaplan}@cert.at

  40. Typical output of postminibis • d407ebf73d25715050bea07fdbfb76a5;2010/11/24-16:15:27; ;a;Se tting autostart-registry-key "HKLM\SOFTWARE\Microsoft\Windows \CurrentVersion\RunServices\Microsoft Update 32" => ,"SUCCESS","Type: REG_SZ, Length: 24, Data: network.exe " 2010/11/22 {wojner,kaplan}@cert.at

  41. Example for interpreting results Top-5 of most-used autorun-registrykeys for 3000 samples $./postminibis ~/Minibis/Results/2010/11/10/120000/ | grep ";a;" | grep "registry" | cut -d\; -f 5 | cut -f 2 -d'"' | sort | uniq - -c | sort -rn 1161 HKLM\SOFTWARE\Microsoft\Windows\ CurrentVersion\Run 887 HKLM\System\CurrentControlSet\ Services 113 HKCU\Software\Microsoft\Windows\ CurrentVersion\Run 101 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit 85 HKLM\Software\Microsoft\Windows\ CurrentVersion\Explorer\Browser Helper Objects 2010/11/22 {wojner,kaplan}@cert.at

  42. Future • ParallelizaKon • Diffs ¡over ¡different ¡VM ¡configuraKons ¡(browser, ¡windows ¡version, ¡etc) • GUI ¡for ¡postminibis ¡ • Installer • Support ¡for ¡more ¡VMs ¡(VMWare, ¡ Qemu) • 64 ¡Bit ¡Linux ¡version, ¡OS ¡X ¡version • Support ¡for ¡physical ¡machines ¡(data ¡ recovery ¡cards) • Support ¡GUI ¡based ¡tools ¡in ¡VM • More ¡sample ¡scripts • Community... 2010/11/22 {wojner,kaplan}@cert.at

  43. Community 2010/11/22 {wojner,kaplan}@cert.at

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal and Wenke Lee College of Computing Georgia Institute of Technology Agenda l Background l Defeating Automated Malware Analysis Host

1.28k views • 28 slides
CS7038 - Malware Analysis - Wk07.2 Malware Research Online Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk07.2 Malware Research Online Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk07.2 Malware Research Online Coleman Kane kaneca@mail.uc.edu February 22, 2018 Exploring the Online Ecosystem One nice aspect of malware analysis is that, since much of it originates online and

119 views • 10 slides
CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane kaneca@mail.uc.edu January 24, 2017 Why Classification is Important Malware classification helps us in multiple ways. Here are a couple key ways:

787 views • 16 slides
MazeWalker Enriching static malware analysis and more Yevgeny Kulakov @p_h_0_e_n_i_x About Me

MazeWalker Enriching static malware analysis and more Yevgeny Kulakov @p_h_0_e_n_i_x About Me

MazeWalker Enriching static malware analysis and more Yevgeny Kulakov @p_h_0_e_n_i_x About Me Malware RE @ Trusteer, IBM, Seculert binary analysis automation sandbox development Now in vEYE Security on software container

591 views • 48 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
Examples of modern malware Malware Analysis Seminar Meeting 7 Cody Cutler, Anton Burtsev

Examples of modern malware Malware Analysis Seminar Meeting 7 Cody Cutler, Anton Burtsev

Examples of modern malware Malware Analysis Seminar Meeting 7 Cody Cutler, Anton Burtsev Stuxnet (2009) Organization Core a large .dll file 2 encrypted configuration files Dropper component Core in a stub section

703 views • 43 slides
T owards Network Containment in Malware Analysis Systems Mariano Graziano, Corrado Leita, Davide

T owards Network Containment in Malware Analysis Systems Mariano Graziano, Corrado Leita, Davide

T owards Network Containment in Malware Analysis Systems Mariano Graziano, Corrado Leita, Davide Balzarotti ACSAC, Orlando, Florida, 3-7 December 2012 Malware Analysis Scenario Analysis based on Sandboxes (API Hooking, Emulation)

798 views • 23 slides
Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware malware that evades analysis 2 logistics: LEX homework detect push ret pattern using fmex probably easier than TRICKY 3 upcoming exam next Wednesday

496 views • 48 slides
Malware analysis using visualized images and entropy graphs Kyoung Soo Han Jae Hyun Lim

Malware analysis using visualized images and entropy graphs Kyoung Soo Han Jae Hyun Lim

Malware analysis using visualized images and entropy graphs Kyoung Soo Han Jae Hyun Lim Boojoong Kang Eul Gyu Im Presented by Ruikai Zheng CISC850 Cyber Analytics 1.Introduction Malware variants developed using automated tools

206 views • 20 slides
Agenda What is Cyber Threat Intelligence (CTI) Sandbox Malware analysis Debugger

Agenda What is Cyber Threat Intelligence (CTI) Sandbox Malware analysis Debugger

PUBLIC Agenda What is Cyber Threat Intelligence (CTI) Sandbox Malware analysis Debugger Malware analysis Static RE with IDA pro Arme suisse EPFL 2019 2 Base daide au commandement BAC Applied Cyber Threat Intelligence

765 views • 63 slides
Towards segment-based recognition of argumentation structure in short texts Andreas Peldszus

Towards segment-based recognition of argumentation structure in short texts Andreas Peldszus

Towards segment-based recognition of argumentation structure in short texts Andreas Peldszus Supervisor: Manfred Stede Applied Computational Linguistics, University of Potsdam 1st ACL WS on Argumentation Mining, June 26, 2014 Andreas Peldszus

554 views • 43 slides
Classical segregation analysis 28.10.2005 GE02 day 4 part 3 Yurii Auchenko Erasmus MC Rotterdam

Classical segregation analysis 28.10.2005 GE02 day 4 part 3 Yurii Auchenko Erasmus MC Rotterdam

Classical segregation analysis 28.10.2005 GE02 day 4 part 3 Yurii Auchenko Erasmus MC Rotterdam Segregation analysis: dominant disease Segregation analysis assuming rare dominant disease: Ascertainment: collect all families with one

464 views • 14 slides
Probability Definition 1 (Experiment). An experiment is a process that can be repeated and may

Probability Definition 1 (Experiment). An experiment is a process that can be repeated and may

Probability Definition 1 (Experiment). An experiment is a process that can be repeated and may result in different outcomes. Definition 2 (Event). An event is a subset of the set of possible outcomes of an experiment. The probability of an event

479 views • 11 slides
Probabilistic Reasoning Philipp Koehn 31 March 2020 Philipp Koehn Artificial Intelligence:

Probabilistic Reasoning Philipp Koehn 31 March 2020 Philipp Koehn Artificial Intelligence:

Probabilistic Reasoning Philipp Koehn 31 March 2020 Philipp Koehn Artificial Intelligence: Probabilistic Reasoning 31 March 2020 Outline 1 Uncertainty Probability Inference Independence and Bayes Rule Philipp Koehn

568 views • 43 slides
Lecture 04: More Process Modelling & Software Metrics 2015-05-04 Prof. Dr. Andreas Podelski,

Lecture 04: More Process Modelling & Software Metrics 2015-05-04 Prof. Dr. Andreas Podelski,

Softwaretechnik / Software-Engineering Lecture 04: More Process Modelling & Software Metrics 2015-05-04 Prof. Dr. Andreas Podelski, Dr. Bernd Westphal 04 2015-05-04 main Albert-Ludwigs-Universit at Freiburg, Germany

2.09k views • 173 slides
Metadata Management for Data Integration in Medical Sciences - Experiences from the LIFE Study -

Metadata Management for Data Integration in Medical Sciences - Experiences from the LIFE Study -

Metadata Management for Data Integration in Medical Sciences - Experiences from the LIFE Study - Toralf Kirsten, Alexander Kiel, Mathias Rhle, Jonas Wagner LIFE Reserach Center for Civilization Diseases University of Leipzig BTW, Stuttgart,

537 views • 20 slides
Probing Emergent Semantics in Predictive Agents via Question Answering Link to slides with

Probing Emergent Semantics in Predictive Agents via Question Answering Link to slides with

Probing Emergent Semantics in Predictive Agents via Question Answering Link to slides with playable videos: bit.ly/3iKYJd3 Abhishek Fede Hamza Laura Rosalia Das* 1 Carnevale* Merzic Rimell Schneider Josh Alden Arjun Stephen Greg

600 views • 40 slides
On the spectral features of robust probing security Maria Chiara Molteni 1 Vittorio Zaccaria 2 1

On the spectral features of robust probing security Maria Chiara Molteni 1 Vittorio Zaccaria 2 1

Context Theoretical contribution Applications Complexity Conclusion On the spectral features of robust probing security Maria Chiara Molteni 1 Vittorio Zaccaria 2 1 Dipartimento di Informatica Giovanni Degli Antoni Universit` a degli

1.03k views • 52 slides

More recommend