Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a...

37
Malware Analysis as a Hobby Michael Boman - Security Consultant/Researcher, Father of 5

Transcript of Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a...

Page 1: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Malware Analysis as a HobbyMichael Boman - Security Consultant/Researcher, Father of 5

Page 2: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Why the strange

hobby?

Page 3: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

The manual way

1.Start virtual environment

2.Copy sample

3.Start logging facilities

4.Execute sample

5.Stop logging facilities

6.Analyze logs

Page 4: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Drawbacks• Time consuming

• Boring in the long run (not all malware are created equal)

Page 5: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Choose any two�.

Cheap

FastGood

Page 6: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Choose any two?

Why not all of them?

I can do it cheaply (hardware and

license cost-wise). Human time not

included.

I can do it quickly (I spend up to 3

hours a day doing this, at average

even less).

I get pretty good results (quality).

Where the system lacks I can

compensate for its shortcomings.

Cheap

FastGood

Page 7: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

AutomateEngineer yourself out of the workflow

Automate

everything!

Automate

everything!

Page 8: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Birth of the

MART ProjectMalware Analyst Research Toolkit

Page 9: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Components

Page 10: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB
Page 11: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Sample Acquisition

• Public & Private Collections

• Exchange with other malware analysts

• Finding and collecting malware yourself• Download files from the web

• Grab attachments from email

• Feed BrowserSpider with links from your SPAM-folder

Page 12: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

BrowserSpider

• Written in Python

• Using the Selenium framework to control REAL browsers

• Flash, PDFs, Java applets etc. executes as per normal

• All the browser bugs exists for real

• Spiders and follows all links seen

Page 13: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Sample Analysis

• Cuckoo Sandbox

• VirusTotal

Page 14: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

A days work for a Cuckoo

Page 15: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

DEMO: Submit sample for analysis

Page 16: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB
Page 17: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Sample ReportingResults are stored in MongoDB

(optional, highly recommended)

Accessed using a analyst GUI

Page 18: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB
Page 19: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB
Page 20: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB
Page 21: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Data Mining

Page 22: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Where Virtual Machine

analysis failsAnd what to do about it

Page 23: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Problems

• Cuckoo is easly bypassed

• User-detection

• Sleeping malware

Page 24: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Problems

• VM or Sandbox detection

• The guest OS might not be sufficient enough

• Any multistage attack

Page 25: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Iterating automatiation

Known

Good

Known

Bad

Unknown

Page 26: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Iterating automatiation

• Does not do anything

• Detects environment

• Encrypted segments

• Failed execution

Page 27: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Iterating automatiation

• Run longer

• Envirnoment customization

Page 28: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB
Page 29: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Budget

• Computer: €520

• MSDN License: €800 (€590 renewal)

• Year 1: €1320

• Year N: €590

• Money saved from stopped smoking (yearly): €2040

Page 30: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Malware Lab

Page 31: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

MART Hardware (overview)

Page 32: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

MART Hardware (mounts)

Page 33: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

MART Hardware (HDD)

Page 34: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

MART Hardware (SSD)

Page 35: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Next steps• Barebone on-the-iron malware

analysis

• Android platform support

• OSX platform support

• iOS patform support

Page 36: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Proof of Concept hardware

Arduino

DuemilanoveEthernet Shield

Prototype Shield

Arduino 4-Channel

Relay Shield

Page 37: Malware Analysis as a Hobby - OWASP Analysis • Cuckoo Sandbox • VirusTotal A days work for a Cuckoo DEMO: Submit sample for analysis Sample Reporting Results are stored in MongoDB

Questions?Michael Boman

[email protected]://michaelboman.org

@mboman

Michael Boman

[email protected]

http://www.2secure.se


Komut satırı üzerinden Analiz - VirusTotal

Komut satırı üzerinden Analiz - VirusTotal

INSTALLATION GUIDE - El Jefe - Threat Analysis€¢ Cuckoo: Cuckoo Sandbox v1.0 for automated malware analysis. • Dependencies : All dependencies needed for the client's installer

INSTALLATION GUIDE - El Jefe - Threat Analysis€¢ Cuckoo: Cuckoo Sandbox v1.0 for automated malware analysis. • Dependencies : All dependencies needed for the client's installer

Practical Malware Analysis - samsclass.info · Basic Analysis • Basic static analysis – View malware without looking at instructions – Tools: VirusTotal, strings – Quick and

Practical Malware Analysis - samsclass.info · Basic Analysis • Basic static analysis – View malware without looking at instructions – Tools: VirusTotal, strings – Quick and

Automated Malware Analysis A Look at Cuckoo Sandbox.

Automated Malware Analysis A Look at Cuckoo Sandbox.

Introduction to malware analysis with Cuckoo Sandbox

Introduction to malware analysis with Cuckoo Sandbox

Cuckoo sandbox

Cuckoo sandbox

Cuckoo Recipe

Cuckoo Recipe

Memory Forensics -  · Memory Forensics An introduction ... Practical Malware Analysis ... Cuckoo Sandbox Yara

Memory Forensics -  · Memory Forensics An introduction ... Practical Malware Analysis ... Cuckoo Sandbox Yara

HERE - Cuckoo Sandbox - Automated Malware Analysis€¢Creator of Cuckoo Sandbox •Founder of Malwr.com HERE •Mark “rep” Schloesser @repmovsb •Security Researcher at Rapid7

HERE - Cuckoo Sandbox - Automated Malware Analysis€¢Creator of Cuckoo Sandbox •Founder of Malwr.com HERE •Mark “rep” Schloesser @repmovsb •Security Researcher at Rapid7

vtapi3 - VirusTotal in Python

vtapi3 - VirusTotal in Python

cuckoo bookmark

cuckoo bookmark

CUCKOO Catalogues

CUCKOO Catalogues

Cuckoo search algorithm

Cuckoo search algorithm

Cuckoo Sandbox Book · 2019-04-02 · Cuckoo Sandbox Book, Release 2.0.2 Cuckoo Sandbox is an open source software for automating analysis of suspicious files. To do so it makes

Cuckoo Sandbox Book · 2019-04-02 · Cuckoo Sandbox Book, Release 2.0.2 Cuckoo Sandbox is an open source software for automating analysis of suspicious files. To do so it makes

2016 HITCON Malware is In the Memory · Cuckoo Sandbox - Malware Automatic Analysis System - Windows ... . ... New Malware Analysis System

2016 HITCON Malware is In the Memory · Cuckoo Sandbox - Malware Automatic Analysis System - Windows ... . ... New Malware Analysis System

Cuckoo Clocks

Cuckoo Clocks

Cuckoo search

Cuckoo search

IMPLEMENTATION ANALYSIS OF CUCKOO SEARCH FOR THE … · CUCKOO SEARCH Cuckoo Search (CS) is an optimization algorithm developed from careful observation, mathematical modelling of

IMPLEMENTATION ANALYSIS OF CUCKOO SEARCH FOR THE … · CUCKOO SEARCH Cuckoo Search (CS) is an optimization algorithm developed from careful observation, mathematical modelling of

Cuckoo postview1

Cuckoo postview1

Malware Analysis as a Hobby - OWASP · 22-11-2012  · • Cuckoo Sandbox • VirusTotal. A days work for a Cuckoo. DEMO: Submit sample for analysis. Sample Reporting Results are

Malware Analysis as a Hobby - OWASP · 22-11-2012  · • Cuckoo Sandbox • VirusTotal. A days work for a Cuckoo. DEMO: Submit sample for analysis. Sample Reporting Results are