av-gantimurov

MISP

Установка в DOCKER

git clone https://github.com/MISP/misp-docker
cd misp-docker
docker compose up

av-gantimurov

"""
Небольшой скрипт для проверки есть ли файл на MalwareBazaar и загрузки в
указанную директорию. Для работы нужен `apikey` MalwareBazaar.
Если директория не указана, то только проверяет наличие файла и сохраняет
полученный ответ в текущую директорию.
Файлы загружает в виде архивов zip с паролем infected. Так отдает MalwareBazaar.
Можно указать список хешей для проверки - опция `-F`.
Поддерживает хеши `md5`, `sha1`, `sha256`.

Python 3.8+

av-gantimurov

Internet simulator

Debian 11

FakeNet-NG

Mitmproxy 8.0

I use mitmproxy for proper certificates generation on-the-fly with preinstalled on VM root cert and exporting preshared SSL keys for traffic decryption.

FakeNet-NG by default using self-signed certificates.

av-gantimurov

#!/usr/bin/env python3
"""
# Description

Simple script for cleaning yara rules.

Delete meta, tags and comments.
Can obfuscate rule names and fix conditions.
Can detect duplicated rules and exclude them.
Doesn't support yara include option.

av-gantimurov

Found namespace 'A2135806-43C6-4A7D-80DD-C322D5C9F2B5'
Found class '5C3A5EFF-0EBA-40BD-AA04-F848E6988197'
Found 788 crypted strings
Found crypted array with 11982 bytes
Decrypted 788 strings
Extracted 788 strings
''
'\x00'
'\x00\x00\x00'
'\x02'

av-gantimurov

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
Script for decoding string in AgentTesla source code for samples from Oct2020
Searches for specific class name. Class name may be defined by command arg.


Author: Gantimurov Alexander
Date: 2020-12-04 10:13
"""

av-gantimurov

'\x00'
'\x00\x00\x00'
'\x02'
'\x03'
'\tINTEGER '
'\tOBJECTIDENTIFIER '
'\tOCTETSTRING '
'\n'
'\r'
'\r\n'

av-gantimurov

#!/usr/bin/env python3
import itertools

def xor(data, key):
    return bytearray(a ^ b for a, b in zip(data, itertools.cycle(key)))

av-gantimurov

Mitmproxy

Steps to configure mitmproxy for ssl interception in malware analysis.

Download and install

wget https://snapshots.mitmproxy.org/5.0.1/mitmproxy-5.0.1-linux.tar.gz --output-document=mitmproxy.tgz
sudo tar -xzvf mitmproxy.tgz -C /usr/local/bin/

Configure

av-gantimurov

List of resources for malware analysts

Books

1. Monappa K.A., "Learning Malware Analysis: Explore the concepts, tools, and techniques to analyze and investigate Windows malware" amazon.
2. Sikorski M., Honig A., "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software" amazon.
3. Ferrie P., "The "Ultimate" Anti-Debugging Reference" [free](https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf