2
Introduction
• What is Malware?(mãl'wâr') - Malicious computer software that interferes with normal computer functions
• What is Automated Malware Analysis?Taking what has been done by highly skilled professionals in extremely time consuming tasks and making it, quick, easy and repeatable. Automated Malware Analysis is being touted as the “Next Generation Anti-Virus” solution.
• Why automate malware analysis?To free up the time from those highly skilled professionals to focus on other things.
3
Difficulties to Overcome
•Malware can be generic or targeted, adding that it can be polymorphic, packed or self modifying code, the number of possibilities are infinite
•Manual malware analysis is time consuming•Traditional static analysis takes a very strong and specific set of skills
•Manually performing dynamic analysis is tedious at best
4
Sandboxing
•Protected runtime environment•Containment•Monitoring•Automation•Complete command execution•Ease of Use
5
Predicaments of Sandboxing
•Commercial solutions are not always cost effective (FireEye, Dambala)
•No guarantee the malware will work the same as in the real world
•Sandbox can be detected•Results can be confusing or overwhelming•Automation of exploit analysis is not trivial
6
Sandboxing Questions
•Why are you doing this?•What do you expect to achieve?•What information is most relevant to me or to my organization?
•Who is the intended audience for the results to be presented to?
•What kind of malware do you want to analyze (Adobe, Office, browser, etc…)?
•Where are the malware samples coming from?
7
Cuckoo Sandbox
•Open source automated malware analysis system•Uses virtualization (VirtualBox, KVM, VMWare)•Python based, easy to customize•Multiple report types (JSON, HTML, MAEC)
•NOT a drop in replacement for commercial solutions at this point. No automated malware identification or loading.
8
Cuckoo Sandbox Data Captured
•Native functions and Windows API calls traces•Copies of files created and deleted from the filesystem•Dump of the memory of the selected process•Screenshots of the desktop during the execution of the malware analysis
•Network dump generated by the machine used for the analysis
10
Scheduler
•Main component•100% Python, easily customizable•Dispatches the pending tasks to the pool of virtual machines available
•Runs all the modules
11
Analyzer
•Executes the malware•Chosen depending on the platform of the selected machine (Windows only at this time)
•100% Python•Monitors and records systems calls•Meat of the analysis
12
Cmonitor
•DLL using chook to install hooks on predefined win32 functions inside process memory
•Gets injected into the target process (QueueUserAPC or CreateRemoteThread)
•Logs the functions calls to files
13
Chook
•Custom inline hooking library•Allows definition of custom hook trampolines•Replaced Microsoft Detours
14
Virtual Machine Usage
•Any VM product can be used
•Works with Windows as the client (though 7 and 2008 server are still buggy)
•Snapshots are used and returned to snapshot state when completed (no infected machine left after analysis)
•Client VM can have any configuration or applications installed to test
15
Execution flow
Fetch a task
Prepare the
analysis
Launch analyzer in virtual machine
Execute an
analysis package
Complete the
analysis
Store the results
Process and
create reports
16
Submitting New Tasks
•Web Interface•Command Line•Options:
•VM to use•Platform (windows only as of v.4)•Timeout•Package•Priority•Malware to be Analyzed
18
Analysis
•Again 100% Python•Defines how the analyzer should start and interact with the malware
•Specified at submission or selected upon file type•Can be written to perform any tasks deemed necessary
19
Packages
•EXEDefault – Windows executables
•DLLYou can specify a function to use otherwise DllMain
•PDFLaunches Acrobat Reader
•DOC or XLSOffice, Need to verify path in package is the same as host OS
•IEHTML/JS Browser testing
•BINShell code or other generic binary data
20
Machine Managers
•Used to manage the Virtual Machines being used
Processing
•Modules used to generate a container of normalized information on the analysis that report generation will use
21
Reporting
•Use the normalized results and do something with them
•Can use MongoDB for customized reporting and tracking
•Built in report types that include all relevant data•Can pull in data from VirusTotal based on MD5
22
Signatures
•Look for patterns or specific events •Assign them a description and severity level•Give context to the reports •Help non-malware experts understand
24
References
• Cuckoo Sandbox is a malware analysis system.http://cuckoosandbox.org/
• Malwr.com is a free malware analysis service based on Cuckoo Sandboxhttp://www.malwr.com/
• VirusTotal is a free service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware.https://www.virustotal.com/
• Honeynet Project is a leading international 501c3 non-profit security research organization, dedicated to investigating the latest attacks and developing open source security tools to improve Internet securityhttp://www.honeynet.org/
• The Pros and Cons of Dynamic Malware Dissectionhttps://www.damballa.com/downloads/r_pubs/WP_Next_Generation_Anti-Virus.pdf