Malware-Analysis - A curated list of awesome malware analysis tools a

项目说明

Malware Analysis

A curated list of awesome malware analysis tools and resources

<img src="malware.png" width="250px" />

Types of Malware Attacks

<table id="tablepress-2">
<thead>
<tr>
<th><center>Type</center></th>
<th><center>What It Does</center></th>
<th><center>Real-World Example</center></th>
</tr>
</thead>
<tbody>
<tr>
<td><center>Ransomware</center></td>
<td><center>disables 's access to data until ransom is paid</center></td>
<td><center>RYUK</center></td>
</tr>
<tr>
<td><center>Fileless Malware</center></td>
<td><center>makes changes to files that are native to the OS</center></td>
<td><center>Astaroth</center></td>
</tr>
<tr>
<td><center>Spyware</center></td>
<td><center>collects user activity data without their knowledge</center></td>
<td><center>DarkHotel</center></td>
</tr>
<tr>
<td><center>Adware</center></td>
<td><center>ser ad</center></td>
<td><center>Fireball</center></td>
</tr>
<tr>
<td><center>Trojans</center></td>
<td><center>disguises itself as desirable code</center></td>
<td><center>Emotet</center></td>
</tr>
<tr>
<td><center>Worms</center></td>
<td><center>spreads through a network by replicating itself</center></td>
<td><center>Stuxnet</center></td>
</tr>
<tr>
<td><center>Rootkits</center></td>
<td><center>gi remote control of a 's device</center></td>
<td><center>Zacinlo</center></td>
</tr>
<tr>
<td><center>Keyloggers</center></td>
<td><center>monitors users' keystrokes</center></td>
<td><center>Olympic </center></td>
</tr>
<tr>
<td><center>Bots</center></td>
<td><center>launches a broad flood of attacks</center></td>
<td><center>Echobot</center></td>
</tr>
<tr>
<td><center>Mobile Malware</center></td>
<td><center>infects mobile devices</center></td>
<td><center>Triada</center></td>
</tr>
</tbody>
</table>

Malware Analysis Proccess

* Static Analysis
* Static Analysis can be done by checking physical states of file. In our case , we used executable file as static samples and to check the physical states of windows executable file Windows provide Portable Executable Format (PE Format) which describes the structure of executable (image) files and object files under the Windows family of operating systems. These files are referred to as Portable Executable (PE) files.

* Dynamic Analysis
* Behaviour Analysis is similar to Dynamic Analysis therefore we created sandbox to find the behaviour of our malicious and good samples and these behaviour includes Registry Operations , Files Operations , Api's Calls , Dll loaded , Mutex Information etc

* Code Analysis
* re code with debugger tools
* Debugging and Reverse Engineering ,Disassemblers, decompiler

* Memory Analysis
* we dumping whole memory and checking for process and handler.
* we can find Rootkit and Ransomware Encryption key and find hidden process !

Tools

* Static Analysis
* pestudio - Perform static analysis of Windows executables.
* CFF Explorer - is a suite of tools for portable executable (PE) checking import directory , export directory and section headers for finding packer [packer use for change pe table schema this UPX]

* Dynamic Analysis
* Process Hacker - Tool that monitors system resources.
* Process Monitor - Ad monitoring tool for Windows programs.
* RegShot - Registry compare utility that compares snapshots.
* ProcDot - A graphical malware analysis tool kit.

* Code Analysis
* Disassembler
* IDA
* Decompiler
* IDA Pro
* debuggers
* X64dbg - An open-source x64/x32 debugger for windows.
* WinDbg - multipurpose debugger for the Microsoft Windows computer operating system

* Memory Forensics
* memory acquisition
* Comae-Toolkit _ use DumpIt.exe for sump whole memory
* memory analysis
* - Ad memory forensics framework.

* Online Scanners and Sandboxes
* Cuckoo Sandbox - Open source, self hosted sandbox and automated analysis system.
* - Free online analysis of malware samples and URLs
* Noriben - Uses Sysinternals Procmon to collect information about malware in a sandboxed en.
* intezer analyzer - Create MITRE ATT&CK Technique Detection table

* Network
* Wireshark - The network traffic analysis tool.

* Android
* MobSF – Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

* service emulation
* INetSim - Network service emulation, useful when building a malware lab.
* FakeNet - Windows Network Simulation tool for Malware Analysis

Useful Language for learn

* Python
* C++
* Assembly

Useful Tools

* yara
* Python 3.8.0 - for ret-sync & ida module
* yara-python - require for ida module
* ret-sync - ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers.

malicious Windows API

* malware tye
* downloader
* urldownloadtofile
* shellexec
* dropper
* findresource
* loadresource
* lockresource
* sizeofresource
* keylogger
* getkeystate
* getasynckeystate
* setwindowshook
* c2 server
* internetopenurla
* socket

Tips

* every .exe file can hav some import dll or aeport dll or string
* new malware dos not use import dll and never call dll, and they are hard to hunt!
* use ida->view->subvie->string to see all sting
* ransomware encrpt data with symetric algoritm like sha256 and then send key to c2, they encrypt key with asymetric algoritm like RSA bublic key
* some malware hade digital signature, an attacker stole sign key from valid company
* for obfuscate pe file use packer
* Fuzzy Hashing tools like ssdeep can help hunter to find similarity between two malware with different md5 key
* Winexex in one of export function from kernel32.dll and can be malicious
* we can bypass all static analysis with rewrite import dll, with call function with address in memory
* we can create shellcode with FASM tools in assembly
* the best future of ida is create basic block for application analysis
* export procmon to csv and send to procdot for create png of malware behaviour
* almost ransomeware are 32 bit, because they can run on 32 bit and 64 bit architect
* some ransomware work when we ha network, we use FakeNet tools for create all network service
* with FakeNet tools and host only, we can see all network connection with c2 server, because 127.0.0.1 set for all dns query
* in windows 8 and upper, ther is patchgaurd mechanism that every 30m check critical section and if detedct some app remo and DKOM attack happen make bluescrean ! with this role most rootkit lose
* we can use psscan command in for finding rootkit and hidden process
* .pdb file is so important for detection function name and indexing of system dll that use in malware
* in we can suspend vm and copy .vmem for memory analysis. the file size is equal to whole memory size
* in ida pro use [tab] key to decompile code, use [x] key to find how many time item called in pe file
* in x64dbg with [F9] key we jumping to entrypoint of program, main function, work with F7,F8 for jumping code

Books

* Practical Malware Analysis
* Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Re Tools, and Obfuscation

reference

* A COMPLETE PRACTICAL APPROACH TO MALWARE ANALYSIS AND MEMORY FORENSICS - 2021 EDITION
* Awesome Malware Analysis
* Malware-analysis-and-Re

Thanks

Taha Ta My Dear master in Malware Analysis Course

项目信息

开发语言：未知

Star 数：172

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A curated list of awesome malware analysis tools and resources展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。