Upload File

malware dynamic analysis

12
Malware Dynamic Analysis Veronica Kovah vkovah.ost at gmail See notes for citation 1 http://opensecuritytraining.info/ MalwareDynamicAnalysis.html

Upload: odessa-spears

Post on 01-Jan-2016

71 views

Category:

Documents


6 download

Report

Tags:

DESCRIPTION

Malware Dynamic Analysis. Veronica Kovah vkovah.ost at gmail. http:// opensecuritytraining.info / MalwareDynamicAnalysis.html. All materials is licensed under a Creative Commons “Share Alike ” license. http:// creativecommons.org /licenses/by- sa /3.0 /. This class is for people. - PowerPoint PPT Presentation

TRANSCRIPT

Page 1: Malware Dynamic Analysis

1

Malware Dynamic Analysis

Veronica Kovahvkovah.ost at gmail

See notes for citation

http://opensecuritytraining.info/MalwareDynamicAnalysis.html

Page 2: Malware Dynamic Analysis

2

All materials is licensed under a Creative Commons “Share Alike” license

http://creativecommons.org/licenses/by-sa/3.0/

See notes for citation

Page 3: Malware Dynamic Analysis

3

This class is for people

• Who are interested in computer security • Who want to understand how malware works • Who want to start working on malware

analysis, or who have recently started

See notes for citation

Page 4: Malware Dynamic Analysis

4

Thanks to

• Xeno Kovah, Ben Schmoker and Frank Poz for reviewing class materials

• Ezra Moses, MITRE Institute tech support for setting up Ubuntu on the lab machines

• Openmalware.org (offensivecomputing.net) for sharing samples, very good resource

See notes for citation

Page 5: Malware Dynamic Analysis

5

About me and you

• BE in CS and MS in CE (but mostly CS background)• Security related work experience:

– Malware analysis and analysis tool development– Security product reverse engineering– Windows memory integrity measurement/verification– Vulnerability research– Network IDS/IPS signature development

• Like hands-on work (coding, debugging, and reversing) • How about you? Any particular topic that you want to

learn from this class?

See notes for citation

Page 6: Malware Dynamic Analysis

6

Outline (1)

• Part 1: Introduction– Observing an isolated malware analysis lab setup– Malware terminology– RAT exploration - Poison IVY– Behavioral analysis

• Part 2: Persistence techniques– Using registry keys– Using file systems– Using Windows services

See notes for citation

Page 7: Malware Dynamic Analysis

7

Outline (2)

• Part 3: Maneuvering techniques– (How malware strategically positions itself to

access critical resources)– DLL/code injection– DLL search order hijacking...

• Part 4: Malware functionality– Keylogging, Phone home, Security degrading, Self-

destruction, etc.

See notes for citation

Page 8: Malware Dynamic Analysis

8

Outline (3)

• Part 5: Using an all-in-one sandbox– Cuckoo Sandbox– Malware Attribute Enumeration and

Characterization (MAEC)– Different sandbox results comparison

• Part 6: Actionable output– Yara – Snort

See notes for citation

Page 9: Malware Dynamic Analysis

9

Books

See notes for citation

Page 10: Malware Dynamic Analysis

10

Class Conventions (1)

• Slides with on the left corner means we will perform hands-on lab activities

• Slides with include answers to lab questions, which often follows lab slides. Please do not read the answersbefore you finish a lab ;)

• Slides with a green bar on top means it’s background context

See notes for citation

Page 11: Malware Dynamic Analysis

11

Class Conventions (2)

• Lines starting with– C:\> means, you are asked to type in a DOS

window on the Windows XP VM but it does not mean the command needs to be executed at the top level

– $ means, you are asked to type in a Linux terminal on the Ubuntu host machine

See notes for citation

Page 12: Malware Dynamic Analysis

12

Class Materials

• On the Ubuntu host machine– $ cd ~/MalwareClass && ls– $ cd ~/Updates && ls– $ virtualbox &

• On the victim VM– On Desktop, open MalwareClass directory

• Please see Notes for citation and check out the original works

See notes for citation


Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis

Static and Dynamic Analysis for Android Malware Detection

MalMax: Multi-Aspect Execution for Automated Dynamic Web Server Malware Analysis · 2020-07-07 · MalMax: Multi-Aspect Execution for Automated Dynamic Web Server Malware Analysis

A Comparative Assessment of Malware … Comparative Assessment of Malware Classification using Binary Texture Analysis and Dynamic Analysis Lakshmanan Nataraj University of California,

Net Malware Dynamic Instrumentation

Basic Dynamic Analysis of Malware

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Reversing malware analysis trainingpart9 advanced malware analysis

Malware Dynamic Analysis Part 2 Veronica Kovah vkovah.ost at gmail See notes for citation1

In-execution dynamic malware analysis and detection by ... · In-execution dynamic malware analysis and detection by mining ... tem calls or adding irrelevant system calls to invalidate

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Malware Dynamic Analysis Part 5

CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis

A Survey on Automated Dynamic Malware Analysis Techniques ... · A Survey on Automated Dynamic Malware Analysis Techniques and Tools · 3 its effects. A bot is a remotely-controlled

NSC-JST workshop · Fighting Malware & Botnets – Introduction ... Automated dynamic malware Behavior Analysis ... summary based on Cuckoo Sandbox

Graph-based Malware Detection Using Dynamic Analysis · Malware frequently uses self-protection measures to thwart debugging and analysis. Ether uses a tactic of zero modification

NTT R&D’s anti-malware technologiesokaweb.ec.kyushu-u.ac.jp/cs/2015-0121/materials/16 hariu.pdfSome malware acts communicating with attacker’s C&C servers, so malware dynamic analysis

NEURLUX: Dynamic Malware Analysis using Neural Networks

6 A Survey on Automated Dynamic Malware-Analysis ...chris/research/doc/acmsurvey12_dynamic.pdf · performing automated dynamic analysis on potentially malicious software. 2. WHAT

malWASH: Washing malware to evade dynamic analysis

6 . Malware Investigation Data Loss Prevention · 2017. 9. 10. · Malware Analysis x Code Types . x Taxonomy . x Classifications . x Malware Analysis ( Static , Dynamic ). x Code

Malware Dynamic Analysis Part 3 Veronica Kovah vkovah.ost at gmail See notes for citation1

Malware Analysis - iswatlab.eu · Malware Sample Gather intelligence from reports and IOCs Basic Static Analysis Dynamic Analysis Forensics Report Delivery Advanced Analysis Sandbox

Malware Dynamic Analysis Part 1 Veronica Kovah vkovah.ost at gmail See notes for citation1

A Survey on Automated Dynamic Malware Analysis Techniques ... survey on automated dynamic... · A Survey on Automated Dynamic Malware Analysis Techniques and Tools · 3 its effects

Malware Analysis - ISWAT · The Malware Analysis Process Malware Sample Threat Intelligence Basic Static Analysis Dynamic Analysis Forensics Advanced Analysis ... Advanced Analysis

Dynamic Malware Analysis - SUPELEC · Dynamic Malware Analysis Christopher Kruegel Secure Systems Lab Technical University Vienna. 2 ... –can cause problems when malware runs in

INTRODUCTION TO DYNAMIC MALWARE ANALYSIS FOR CYBER ...€¦ · INTRODUCTION TO DYNAMIC MALWARE ANALYSIS FOR CYBER INTELLIGENCE AND FORENSICS P V Vara Prasad Assistant Professor, Koneru

Attack and Defense of Dynamic Analysis-Based, Adversarial Neural Malware … · 2017-12-19 · malware is either packed or encrypted, malware classification based on static analysis

Malware Analysis on the Cloud: Increased Performance ... · Malware analysis can be broadl y broken down into static and dynamic analysis [EGEL08] and efforts have been made to advance

Dynamic Malware Detection and Phylogeny Analysis using ... › sites › default › files › dynamic... · Dynamic Malware Detection and Phylogeny Analysis using Process Mining

Advanced malware analysis training session6 malware sandbox analysis

A Comparative Assessment of Malware Classification using ...A Comparative Assessment of Malware Classification using Binary Texture Analysis and Dynamic Analysis Lakshmanan Nataraj

Malware Dynamic Analysis Part 6 Veronica Kovah vkovah.ost at gmail See notes for citation1