nganhkhoa/mether049-malware
1
0
Fork 0
mirror of https://github.com/nganhkhoa/malware.git synced 2024-06-10 21:32:07 +07:00
Code Issues Projects Releases Wiki Activity
862c03659f
mether049-malware/malware-analysis_ref_and_memo.md
mether049 862c03659f
Update malware-analysis_ref_and_memo.md
2020-02-04 00:02:51 +09:00

9.5 KiB
Raw Blame History

Tools

OS/VM

  • FLARE VM
    FireEye社が提供するマルウェア解析, DFIR, ペネトレーションテストに特化したWindowsベースのディストリビューション
    Practical Malware Analysis Labsが同梱
  • REMnux
    SANSが提供するリバースエンジニアリング，マルウェア解析に特化したUbuntuベースのディストリビューション
  • Tsurugi Linux
    DFIR,マルウェア解析，OSINTに特化したUbuntuベースのディストリビューション

Static Analysis and Debug tools

※空欄は調査中(更新予定)

name disassembler decompiler debugger reference
IDA pro 〇 〇(Not free) 〇
Binary Ninja 〇
Cutter 〇 r2dec,r2ghidra native
gdb
windbg
etc.		 INTRO TO CUTTER FOR MALWARE ANALYSIS(2019-03)
megabeets.net
Cutter: Presenting r2ghidra Decompiler,r2con 2019
Ghidra 〇 〇 Reversing WannaCry Part 2 - Diving into the malware with #Ghidra,youtube
https://www.youtube.com/watch?v=Q90uZS3taG0 x64/x32dbg 〇 Snowman 〇
WinDbg 〇 〇
GDB 〇 〇
objdump 〇
Snowman 〇
name plugin price platform remarks
IDA pro Lighthouse
UEFI_RETool		 Not free multi
Binary Ninja Lighthouse Not free
Cutter CutterDRcov
Jupyter Plugin for Cutter
x64dbgcutter
etc.		 free multi
Ghidra pwndra
ghidra_scripts
OOAnalyzer		 free multi
x64/x32dbg DbgChild free windows
WinDbg free windows Kernel mode debugging possible
GDB gdbpeda
pwngdb		 free linux
objdump free linux
Snowman

Tracer

  • drltrace
    • DynamoRIO based
    • ライブラリトレーサ(Windows版ltrace)
  • drstrace
    • DynamoRIO based
    • システムコールトレーサ(Windows版strace)
  • memtrace
    • DynamoRIO based
    • メモリトレーサ
  • bbbuf
    • DynamoRIO based
    • べーシックブロックトレーサ
  • API Monitor
    • GUI(Windows)
    • APIコールを監視ツール

Instrumentation

  • drcov
    • DynamoRIO based
    • カバレッジ計測
    • drrun経由で実行
> drrun.exe -t drcov -- [program name] [arguments]
  • Intel PIN

Traffic Analysis tools

Forensic

  • Sysinternals
  • Volatility
    • malconfscan
    • hollowfind

Threat hunting

  • EQL

.NET analysis

  • dnspy
    .NETデコンパイラ,C#やVBで作成された実行ファイルを高精度でデコンパイルする

Utilities

  • PeBear
  • PeStudio
  • ResourceHacker
  • PEiD
  • 010 Editor
  • Process Hacker
  • RegShot
  • RegistryChangesView
  • CyberChef

Online Sandbox

name site remarks
AMAaaS https://amaaas.com/ apk only
ANYRUN https://app.any.run/#register
Intezer Analyze https://analyze.intezer.com/#/
IRIS-H https://iris-h.services/pages/dashboard maldoc only
CAPE Sandbox https://cape.contextis.com/
Joe Sandbox Cloud https://www.joesandbox.com/
cuckoo https://cuckoo.cert.ee/
cuckoo https://sandbox.pikker.ee/
Hybrid Analysis https://www.hybrid-analysis.com/?lang=ja
ViCheck https://www.vicheck.ca/submitfile.php
Triage https://tria.ge/
Yomi Sandbox https://yomi.yoroi.company/upload
UnpacMe https://www.unpac.me/#/ online unpacker,beta

Unpacker/Decryptor/Decoder/Extractor/Memory Scanner

  • Process Creattion
  • Registry Operations
  • Threads Operations
  • Virtual Alloc Operations
  • Image Load Operations
  • Kernel Audit APIs usage
  • etc.

Doc Analysis

C2 Analysis

Emotet

  • Emutet
    Emotetのc2通信部分のエミュレータ

Ursnif

Binary Analysis

Symbolic Execurtion

to do...

Taint Analysis

to do...

Decompiler

to do...

ref: