extracting-iocs-from-malware-samples

从恶意软件样本中提取 IOC

适用场景

• 完成恶意软件分析（静态或动态），需要提取可用于防御团队的指标
• 根据已分析的样本，为防火墙、代理和 DNS 黑洞构建阻止列表
• 根据恶意软件伪影创建 YARA 规则、Snort/Suricata 签名或 SIEM 检测内容
• 向威胁情报共享平台（MISP、OTX、ThreatConnect）贡献数据
• 通过关联多个样本中的 IOC 跟踪恶意软件活动

请勿用于未经验证来源的 IOC；阻止列表中的误报可能会干扰正常的业务运营。

前提条件

• 安装了 iocextract、pefile、yara-python 库的 Python 3.8+
• 已完成的恶意软件分析报告（静态分析、动态分析或逆向工程）
• 可访问分析过程中生成的 PCAP 文件、内存转储或沙箱报告
• 用于结构化 IOC 共享的 MISP 实例或 STIX/TAXII 服务
• 用于丰富和验证 IOC 的 VirusTotal API 密钥
• 用于解码混淆指标的 CyberChef

工作流

第 1 步：提取基于文件的 IOC

计算哈希并识别文件元数据指标：

# Generate all standard hashes
md5sum malware_sample.exe
sha1sum malware_sample.exe
sha256sum malware_sample.exe

# Generate ssdeep fuzzy hash for similarity matching
ssdeep malware_sample.exe

# Generate imphash (import hash) for PE files
python3 -c "
import pefile
pe = pefile.PE('malware_sample.exe')
print(f'Imphash: {pe.get_imphash()}')
"

# Generate TLSH (Trend Micro Locality Sensitive Hash)
python3 -c "
import tlsh
with open('malware_sample.exe', 'rb') as f:
    h = tlsh.hash(f.read())
print(f'TLSH: {h}')
"

# Compile file metadata IOCs
python3 << 'PYEOF'
import pefile
import os
import hashlib
import datetime

pe = pefile.PE("malware_sample.exe")

print("FILE IOCs:")
with open("malware_sample.exe", "rb") as f:
    data = f.read()
    print(f"  MD5:        {hashlib.md5(data).hexdigest()}")
    print(f"  SHA-1:      {hashlib.sha1(data).hexdigest()}")
    print(f"  SHA-256:    {hashlib.sha256(data).hexdigest()}")
    print(f"  File Size:  {len(data)} bytes")

ts = pe.FILE_HEADER.TimeDateStamp
print(f"  Compile:    {datetime.datetime.utcfromtimestamp(ts)} UTC")
print(f"  Imphash:    {pe.get_imphash()}")
PYEOF

第 2 步：提取网络 IOC

从字符串、PCAP 和沙箱报告中提取网络指标：

# Extract network IOCs from strings
import re

with open("malware_sample.exe", "rb") as f:
    data = f.read()

# Extract ASCII and Unicode strings
ascii_strings = re.findall(b'[ -~]{4,}', data)
unicode_strings = re.findall(b'(?:[ -~]\x00){4,}', data)

all_strings = [s.decode('ascii', errors='ignore') for s in ascii_strings]
all_strings += [s.decode('utf-16-le', errors='ignore') for s in unicode_strings]

# IP addresses (excluding private ranges for C2 indicators)
ip_pattern = re.compile(r'\b(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)\b')
ips = set()
for s in all_strings:
    for ip in ip_pattern.findall(s):
        # Filter out private/reserved ranges
        octets = [int(o) for o in ip.split('.')]
        if octets[0] not in [10, 127, 0] and not (octets[0] == 172 and 16 <= octets[1] <= 31) and not (octets[0] == 192 and octets[1] == 168):
            ips.add(ip)

# Domain names
domain_pattern = re.compile(r'\b[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z]{2,})+\b')
domains = set()
for s in all_strings:
    for d in domain_pattern.findall(s):
        if not d.endswith(('.dll', '.exe', '.sys', '.com.au')):
            domains.add(d)

# URLs
url_pattern = re.compile(r'https?://[^\s<>"{}|\\^`\[\]]+')
urls = set()
for s in all_strings:
    for u in url_pattern.findall(s):
        urls.add(u)

print("NETWORK IOCs:")
print(f"  IPs:     {ips}")
print(f"  Domains: {domains}")
print(f"  URLs:    {urls}")

第 3 步：提取基于主机的 IOC

识别文件路径、注册表项、互斥体和服务：

# Extract host-based IOCs from sandbox report
import json

with open("cuckoo_report.json") as f:
    report = json.load(f)

print("HOST IOCs:")

# File paths created or modified
print("\nFile Paths:")
for f in report["behavior"]["summary"].get("files", []):
    if any(p in f.lower() for p in ["temp", "appdata", "system32", "programdata"]):
        print(f"  [DROPPED] {f}")

# Registry keys for persistence
print("\nRegistry Keys:")
for key in report["behavior"]["summary"].get("write_keys", []):
    if any(p in key.lower() for p in ["run", "service", "startup", "shell"]):
        print(f"  [PERSIST] {key}")

# Mutexes (unique to malware family)
print("\nMutexes:")
for mutex in report["behavior"]["summary"].get("mutexes", []):
    if mutex not in ["Local\\!IETld!Mutex", "RasPbFile"]:  # Filter known Windows mutexes
        print(f"  [MUTEX] {mutex}")

# Created services
print("\nServices:")
for svc in report["behavior"]["summary"].get("started_services", []):
    print(f"  [SERVICE] {svc}")

第 4 步：从 PCAP 中提取网络 IOC

解析网络捕获数据，获取更多指标：

# Extract DNS queries from PCAP
tshark -r capture.pcap -T fields -e dns.qry.name -Y "dns.flags.response == 0" | sort -u

# Extract HTTP hosts and URLs
tshark -r capture.pcap -T fields -e http.host -e http.request.uri -Y "http.request" | sort -u

# Extract TLS server names (SNI)
tshark -r capture.pcap -T fields -e tls.handshake.extensions_server_name -Y "tls.handshake.type == 1" | sort -u

# Extract JA3 hashes
tshark -r capture.pcap -T fields -e tls.handshake.ja3 -Y "tls.handshake.type == 1" | sort -u

# Extract unique destination IPs
tshark -r capture.pcap -T fields -e ip.dst -Y "ip.src == 10.0.2.15" | sort -u

# Extract User-Agent strings
tshark -r capture.pcap -T fields -e http.user_agent -Y "http.user_agent" | sort -u

第 5 步：对 IOC 进行脱敏和验证

对指标进行脱敏，以便安全共享；并根据威胁情报进行验证：

# Defang IOCs for safe sharing
def defang_ip(ip):
    return ip.replace(".", "[.]")

def defang_url(url):
    return url.replace("http", "hxxp").replace(".", "[.]")

def defang_domain(domain):
    return domain.replace(".", "[.]")

# Validate IOCs against VirusTotal
import requests

VT_API_KEY = "your_api_key"

def check_vt_ip(ip):
    resp = requests.get(f"https://www.virustotal.com/api/v3/ip_addresses/{ip}",
                       headers={"x-apikey": VT_API_KEY})
    data = resp.json()
    stats = data["data"]["attributes"]["last_analysis_stats"]
    return stats["malicious"]

def check_vt_domain(domain):
    resp = requests.get(f"https://www.virustotal.com/api/v3/domains/{domain}",
                       headers={"x-apikey": VT_API_KEY})
    data = resp.json()
    stats = data["data"]["attributes"]["last_analysis_stats"]
    return stats["malicious"]

# Validate each IOC
for ip in ips:
    detections = check_vt_ip(ip)
    print(f"  {defang_ip(ip)} - VT: {detections} detections")

第 6 步：以标准格式导出 IOC

生成结构化 IOC 输出，以供共享和导入：

# Export as STIX 2.1 bundle
from stix2 import Indicator, Bundle, Malware, Relationship
import datetime

indicators = []

# File hash indicator
indicators.append(Indicator(
    name="Malware SHA-256 Hash",
    pattern=f"[file:hashes.'SHA-256' = '{sha256_hash}']",
    pattern_type="stix",
    valid_from=datetime.datetime.now(datetime.timezone.utc),
    labels=["malicious-activity"]
))

# IP indicator
for ip in ips:
    indicators.append(Indicator(
        name=f"C2 IP Address {ip}",
        pattern=f"[ipv4-addr:value = '{ip}']",
        pattern_type="stix",
        valid_from=datetime.datetime.now(datetime.timezone.utc),
        labels=["malicious-activity"]
    ))

# Domain indicator
for domain in domains:
    indicators.append(Indicator(
        name=f"C2 Domain {domain}",
        pattern=f"[domain-name:value = '{domain}']",
        pattern_type="stix",
        valid_from=datetime.datetime.now(datetime.timezone.utc),
        labels=["malicious-activity"]
    ))

bundle = Bundle(objects=indicators)
with open("iocs_stix.json", "w") as f:
    f.write(bundle.serialize(pretty=True))

# Export as CSV for SIEM ingestion
import csv
with open("iocs.csv", "w", newline="") as f:
    writer = csv.writer(f)
    writer.writerow(["type", "value", "context", "confidence"])
    writer.writerow(["sha256", sha256_hash, "malware_sample", "high"])
    for ip in ips:
        writer.writerow(["ipv4", ip, "c2_server", "high"])
    for domain in domains:
        writer.writerow(["domain", domain, "c2_domain", "high"])
    for url in urls:
        writer.writerow(["url", url, "c2_url", "high"])

核心概念

术语	定义
IOC（入侵指标）	在网络或系统中观察到的、表明可能发生入侵的取证伪影：哈希、IP、域名、文件路径、注册表项
脱敏	修改 IOC 以防止意外激活（例如，在 URL 和 IP 中将点替换为 [.]，以便在报告中安全共享）
Imphash	PE 文件导入表函数的 MD5 哈希；同一恶意软件家族的样本通常具有相同的 imphash
STIX/TAXII	结构化威胁信息表达 / 可信自动化交换；用于编码和传输威胁情报的标准
JA3/JA3S	基于 ClientHello/ServerHello 参数的 TLS 客户端/服务端指纹；可根据 TLS 实现识别特定恶意软件家族
模糊哈希（ssdeep）	基于上下文触发的分段哈希，即使文件略有修改也能识别相似文件；适用于检测恶意软件变种
MISP	恶意软件信息共享平台；用于收集、存储和共享 IOC 的开源威胁情报平台

工具与系统

• iocextract（Python）：自动 IOC 提取库，支持从文本中提取 IP、URL、域名、哈希和 YARA 规则
• MISP：用于结构化 IOC 管理和分发的开源威胁情报共享平台
• CyberChef：基于 Web 的工具，可用于解码、解密和转换数据，适合对经过编码的 IOC 进行反混淆
• tshark：命令行网络协议分析器，可从 PCAP 文件中提取网络 IOC
• VirusTotal：在线服务，可利用社区检测结果和威胁情报验证并丰富 IOC

常见场景

场景：根据勒索软件样本构建全面的 IOC 包

背景：勒索软件事件要求迅速提取 IOC，以便在企业范围内进行拦截，同时继续开展完整调查。现有多个数据源：样本二进制文件、网络监控捕获的 PCAP，以及 Cuckoo 沙箱报告。

方法：

1. 计算勒索软件二进制文件及所有释放文件的文件哈希（MD5、SHA-1、SHA-256、imphash、ssdeep）
2. 从二进制文件的字符串中提取网络 IOC（硬编码的 C2 地址）
3. 解析 PCAP，提取 DNS 查询、HTTP 请求和 TLS SNI 字段
4. 从沙箱报告中提取主机 IOC（文件路径、注册表项、互斥体、勒索信文件名）
5. 通过 VirusTotal 验证所有网络 IOC，确认其恶意状态并检查已知关联
6. 对所有指标进行去武器化处理，并整理为 STIX 2.1 格式以供共享，以及 CSV 格式以供 SIEM 导入
7. 提交至 MISP 事件，以便组织内部及社区共享

注意事项：

• 未验证上下文就纳入合法 CDN 或云服务的 IP 地址（例如，用于托管的 AWS IP 并非天然具有恶意）
• 未对报告中的 URL 和 IP 进行去武器化处理，可能导致意外点击或 DNS 解析
• 从加壳二进制文件中提取字符串（加壳样本中的 IOC 不可靠；应先脱壳）
• 忘记纳入释放文件的哈希（初始投放器和最终载荷是不同的 IOC）

输出格式

IOC EXTRACTION REPORT
======================
Sample:           ransomware.exe
Analysis Date:    2025-09-15
Analyst:          [Name]

FILE INDICATORS
SHA-256:          e3b0c44298fc1c149afbf4c8996fb924...
SHA-1:            da39a3ee5e6b4b0d3255bfef95601890afd80709
MD5:              d41d8cd98f00b204e9800998ecf8427e
Imphash:          a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
ssdeep:           3072:kJh3bN7fY+aUkJh3bN7fY+aU:kJh3R7aUkJh3R7aU

NETWORK INDICATORS
C2 IPs:           185.220.101[.]42, 91.215.85[.]17
C2 Domains:       update.malicious[.]com, backup.evil[.]net
C2 URLs:          hxxps://update.malicious[.]com/gate.php
                  hxxps://backup.evil[.]net/gate.php
JA3 Hash:         a0e9f5d64349fb13191bc781f81f42e1
User-Agent:       Mozilla/5.0 (compatible; MSIE 10.0)

HOST INDICATORS
File Paths:       C:\Users\Public\svchost.exe
                  C:\Users\%USER%\AppData\Local\Temp\payload.dll
                  C:\Users\%USER%\Desktop\README_DECRYPT.txt
Registry Keys:    HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate
Mutexes:          Global\CryptLocker_2025_Q3
Services:         FakeWindowsUpdate

CONFIDENCE ASSESSMENT
High Confidence:  SHA-256, C2 IPs (validated via VT), Mutexes
Medium Confidence: Domains (could be compromised legitimate sites)
Low Confidence:   User-Agent (common string, high false positive risk)

EXPORT FILES
stix_bundle.json  - STIX 2.1 format for TIP ingestion
iocs.csv          - Flat CSV for SIEM blocklist import
yara_rule.yar     - YARA detection rule