nganhkhoa/mether049-malware
1
0
Fork 0
mirror of https://github.com/nganhkhoa/malware.git synced 2024-06-10 21:32:07 +07:00
Code Issues Projects Releases Wiki Activity

Update malware-analysis_ref_and_memo.md

Browse Source
This commit is contained in:
mether049 2020-01-28 01:44:30 +09:00 committed by GitHub
parent 809a3ecac6
commit d141caa7ff
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
malware-analysis_ref_and_memo.md
View File

@ -95,13 +95,27 @@
|Yomi Sandbox|https://yomi.yoroi.company/upload||
|UnpacMe|https://www.unpac.me/#/|online unpacker,beta|
### Unpacker/Decryptor/Extractor
### Unpacker/Decryptor/Detector/Extractor
- 攻撃者グループTA505が利用するマルウェア(GetandGoDll, Silence, TinyMet, Azorult, KBMiner, etc.)の静的アンパッカー<br>
[TAFOF-Unpacker](https://github.com/Tera0017/TAFOF-Unpacker)
- Trickbotのartifactを取得するためのdecrypter<br>
[Trickbot artifact decrypter](https://github.com/snemes/malware-analysis/tree/master/trickbot)
- Injecition/Hollowingされたプロセスの抽出<br>
[Memhunter](https://github.com/marcosd4h/memhunter)
- Injecition/Hollowingされたプロセスの自動検出<br>
[Memhunter](https://github.com/marcosd4h/memhunter)<br>
- メモリダンプが不要で，感染環境でメモリスキャンを行う
- メモリスキャンのヒューリスティックトリガーにETWデータを利用している
- ETWのSuspicious Eventsとして以下を定義
> - Process Creattion<br>
> - Registry Operations<br>
> - Threads Operations<br>
> - Virtual Alloc Operations<br>
> - Image Load Operations<br>
> - Kernel Audit APIs usage<br>
> - etc.<br>
- **ref:**
- [Memhunter (Memory resident malware hunting at scale)](https://docs.google.com/presentation/d/1hgx2FTNIkry9Nt8LOJVz_rHNhcGfJChxZVGckv7VI8E/edit#slide=id.g5712e7065f_1_1)
- [Reflective DLL Injection Detection through Memhunte,youtube](https://www.youtube.com/watch?v=t_fR1sCENkc)
- [Process Hollowing Injection Detection through Memhunter,youtube](https://www.youtube.com/watch?v=QxCguP76uyg)
# Doc Analysis