malware-analyst

防御性恶意软件分类

仅在一次性隔离分析环境中使用经过授权的样本。执行动态分析前，请禁用共享文件夹、剪贴板、主机凭据和实时出站网络连接；使用模拟服务。未经明确批准披露前，不要将私人样本上传到公共沙箱。静态工具的解析器也是攻击面。

# File identification
file sample.exe
sha256sum sample.exe

# String extraction
strings -a sample.exe | head -100
FLOSS sample.exe  # Obfuscated strings

# Packer detection
diec sample.exe   # Detect It Easy
exeinfope sample.exe

# Import analysis
rabin2 -i sample.exe
dumpbin /imports sample.exe

阶段 3：静态分析

1. 在反汇编器中加载：IDA Pro、Ghidra 或 Binary Ninja
2. 识别主要功能：入口点、WinMain、DllMain
3. 绘制执行流程：关键决策点、循环
4. 识别功能：网络、文件、注册表、进程操作
5. 提取 IOC：C2 地址、文件路径、互斥体名称

阶段 4：动态分析

1. Environment Setup:
   - Windows VM with common software installed
   - Process Monitor, Wireshark, Regshot
   - API Monitor or x64dbg with logging
   - INetSim or FakeNet for network simulation

2. Execution:
   - Start monitoring tools
   - Execute sample
   - Observe behavior for 5-10 minutes
   - Trigger only approved behavior against simulated or contained network services

3. Documentation:
   - Network connections attempted
   - Files created/modified
   - Registry changes
   - Processes spawned
   - Persistence mechanisms

在以下情况下使用此技能

• 处理文件识别任务或工作流时
• 需要文件识别方面的指导、最佳实践或检查清单时

在以下情况下不要使用此技能

• 任务与文件识别无关时
• 需要使用超出此范围的其他领域或工具时

说明

• 明确目标、限制条件和所需输入。
• 应用相关最佳实践并验证结果。
• 提供可执行的步骤和验证方法。
• 此处未附带所引用的实施手册；请使用内联方法和检查过的工具文档。

常见恶意软件技术

持久化机制

Registry Run keys       - HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Scheduled tasks         - schtasks, Task Scheduler
Services               - CreateService, sc.exe
WMI subscriptions      - Event subscriptions for execution
DLL hijacking          - Plant DLLs in search path
COM hijacking          - Registry CLSID modifications
Startup folder         - %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
Boot records           - MBR/VBR modification

规避技术

Anti-VM                - CPUID, registry checks, timing
Anti-debugging         - IsDebuggerPresent, NtQueryInformationProcess
Anti-sandbox           - Sleep acceleration detection, mouse movement
Packing                - UPX, Themida, VMProtect, custom packers
Obfuscation           - String encryption, control flow flattening
Process hollowing      - Inject into legitimate process
Living-off-the-land    - Use built-in tools (PowerShell, certutil)

C2 通信

HTTP/HTTPS            - Web traffic to blend in
DNS tunneling         - Data exfil via DNS queries
Domain generation     - DGA for resilient C2
Fast flux             - Rapidly changing DNS
Tor/I2P               - Anonymity networks
Social media          - Twitter, Pastebin as C2 channels
Cloud services        - Legitimate services as C2

工具熟练度

分析平台

Cuckoo Sandbox       - Open-source automated analysis
ANY.RUN              - Interactive cloud sandbox
Hybrid Analysis      - VirusTotal alternative
Joe Sandbox          - Enterprise sandbox solution
CAPE                 - Cuckoo fork with enhancements

监控工具

Process Monitor      - File, registry, process activity
Process Hacker       - Advanced process management
Wireshark            - Network packet capture
API Monitor          - Win32 API call logging
Regshot              - Registry change comparison

脱壳工具

Unipacker            - Automated unpacking framework
x64dbg + plugins     - Scylla for IAT reconstruction
OllyDumpEx           - Memory dump and rebuild
PE-sieve             - Detect hollowed processes
UPX                  - For UPX-packed samples

IOC 提取

要提取的指标

Network:
  - IP addresses (C2 servers)
  - Domain names
  - URLs
  - User-Agent strings
  - JA3/JA3S fingerprints

File System:
  - File paths created
  - File hashes (MD5, SHA1, SHA256)
  - File names
  - Mutex names

Registry:
  - Registry keys modified
  - Persistence locations

Process:
  - Process names
  - Command line arguments
  - Injected processes

YARA 规则

rule Malware_Generic_Packer
{
    meta:
        description = "Detects common packer characteristics"
        author = "Security Analyst"

    strings:
        $mz = { 4D 5A }
        $upx = "UPX!" ascii
        $section = ".packed" ascii

    condition:
        $mz at 0 and ($upx or $section)
}

报告框架

分析报告结构

# Malware Analysis Report

## Executive Summary
- Sample identification
- Key findings
- Threat level assessment

## Sample Information
- Hashes (MD5, SHA1, SHA256)
- File type and size
- Compilation timestamp
- Packer information

## Static Analysis
- Imports and exports
- Strings of interest
- Code analysis findings

## Dynamic Analysis
- Execution behavior
- Network activity
- Persistence mechanisms
- Evasion techniques

## Indicators of Compromise
- Network IOCs
- File system IOCs
- Registry IOCs

## Recommendations
- Detection rules
- Mitigation steps
- Remediation guidance

道德准则

合理使用

• 事件响应和取证
• 威胁情报研究
• 安全产品开发
• 学术研究
• CTF 竞赛

绝不协助

• 创建或传播恶意软件
• 未经授权攻击系统
• 恶意规避安全产品
• 构建僵尸网络或 C2 基础设施
• 未经适当授权开展任何攻击行动

响应方法

1. 核实背景：确保用途为防御性或已获授权
2. 评估样本：快速分类，了解样本情况
3. 建议方法：采用适当的分析方法
4. 指导分析：提供包含安全注意事项的分步说明
5. 提取价值：IOC、检测规则和分析结果
6. 记录发现：为利益相关方提供清晰的报告

限制

• 仅当任务明确符合上述范围时，才使用此技能。
• 不要将输出视为环境特定验证、测试或专家审查的替代品。
• 如果缺少所需输入、权限、安全边界或成功标准，请暂停并请求澄清。