Malware Analysis: Tools of the Trade

Excellent information gathering by Lorna Hutcheson in this Internet Storm Center Handler’s Diary Entry. From the diary entry:

First I want to thank everyone who sent in tools for this endeavor. I hope that this list of tools continues to grow and everyone can get good use out of it. If you look at the diary entry that launched this endeavor, you will find the information that I’m looking to obtain about the tools. If you have some that need would be good to list here, please pass them along and I’ll update the list. Some folks sent in entries and checked the box not to have thier names mentioned, so there are no names by those submissions. If you want me to include your name, I’d love to, but you need to give me permission first when you submit the information. All information has been submitted as provided. If you have any additions, I’d be happy to add them!

The List:
1.   Malcode Analyst Pack

a. Where you can get it (if known)- iDefense http://labs.idefense.com/labs-software.php?show=8
b. Shareware/Freeware- GPL/Freeware
c.  What it does-
This install package contains a handful of small utility type applications that have proven useful while analyzing malicious code.
These are quick tools designed to meet specific needs while in a malcode testing lab environment. Functionality is tailored specifically to these ends, implementation may be crude at some points but all have proven utility.
This package includes:
       • ShellExt      – explorer shell extensions
       • socketTool    – manual TCP Client for probing functionality.
       • MailPot       – mail server capture pot
       • fakeDNS       – spoofs dns responses to controlled ip’s
       • sniff_hit     – HTTP, IRC, and DNS sniffer
       • sclog – Shellcode research and analysis application
       • IDCDumpFix    – aids in quick RE of packed applications
       • Shellcode2Exe – embeds multiple shellcode formats in exe husk
       • GdiProcs      – used to detect hidden processes

d.  Tips for using it or gotchas- N/A
e.  Is the source of the tool considered trustworthy?- as trustworthy as iDefense is :)
f.   Screen Shots of the tool in action (optional)- there is a wmv of the shellcode logger usage on the site (link at bottom of page)
g.   Links to additional resource information about the tool- N/A

2.  RegMon, FileMon, Ethereal:  Submitted by Ronan Rose

a.  Where you can get it (if known)- 
     RegMon, FileMon and TCPView at www.sysinternals.com
     Ethereal: Included with red hat many linux distros
     MSVPC: microsoft.com (trial)
b.  Shareware/Freeware-  unknown – trial versions / freeware
c.  What it does: 

  • RegMon: monitors processes accessing the registry.
  •  FileMon: monitors processes accessing file system.
  •  TCPview: lets you see in real time what applications are listening on your ports.
  •  Ethereal: will give you a good view of what is happening on the network at a packet level.
  •  MSVPC: will allow you to set up a network on your PC. I have a 2.4 ghz, 60GB HD and 750 mb ram which allows me to run 3 VMs simultaneously in a LAN – server2003 to provide dns, ftp, smtp etc,
  • Win2k client as Malware host and to run filemon and reg mon on, and redhat 7.2 vm to use ethereal
d.  Tips for using it or gotchas-
  • In the case of malware with Regmon look for processes polling the “run” keys in the registry . You will need to exclude some processes from both tools (there is quiet alot happening under the bonnet in windows) to improve legability, but if you are still not finding your problem, remember that some malware can inject itself into legit processes, so drop any filters and start again.
  • Filemon should show you any process that is systematically looking for information on your hard drive.
  • TCPview lets you see in real time what applications are listening on your ports.  Some of the newer malware claims to be able to defeat some of the file, registry, tcp view type apps with rootkits etc. When in doubt, check ethereal – if the network is still busy, then you are still infected!
e.  Is the source of the tool considered trustworthy?  All tools are trustworthy and come from a reliable source.
f.   Screen Shots of the tool in action (optional)-
g.   Links to additional resource information about the tool-

3.  Windows 2000 RAM dump parsing tools:  Submitted by Harlan Carvey

a. Where you can get it (if known)- http://sourceforge.net/project/showfiles.php?group_id=164158
b. Shareware/Freeware-
c.  What it does-
d.  Tips for using it or gotchas-   The tools themselves should be platform-independant, and only require Perl.  I’ve had previous versions tested on Linux, and even a Mac G5.
e.  Is the source of the tool considered trustworthy?
f.   Screen Shots of the tool in action (optional)-
g.   Links to additional resource information about the tool-

4.  Wireshark, formerly Ethereal

a. Where you can get it (if known)- http://www.wireshark.org/
b. Shareware/Freeware- Free & Open source
c.  What it does-  Analyzes network traffic & packets. Useful for observing if and where malware is attempting to deliver/recieve payload(s) and via which protocol(s).
d.  Tips for using it or gotchas-  
e.  Is the source of the tool considered trustworthy?  Yes, trustworthy, would run it on primary systems if needed. Open source, can compile from source code if desired. Having access to the full source code for scrutiny adds to the level of trust.
f.   Screen Shots of the tool in action (optional)-
g.   Links to additional resource information about the tool-  Numerous links available on the Wireshark home page,  www.wireshark.org

5.  OllyDbg:  Submitted by Vince Maes

a. Where you can get it (if known)- http://www.ollydbg.de/
b. Shareware/Freeware- OllyDbg is a shareware, but you can download and use it for free.
c.  What it does-  Provides binary code analysis for Windows-based malware.  Some of it’s best features are:

-Attaches to running programs
-Analyzes complex code constructs such as call to jump to procedure
-Sets conditional, logging, memory and hardware breakpoints
-Traces execution and logs arguments of known functions.
-And lots more…
d.  Tips for using it or gotchas-  
e.  Is the source of the tool considered trustworthy? 
f.   Screen Shots of the tool in action (optional)-
g.   Links to additional resource information about the tool- 

6.  IDA Pro:  Submitted by Vince Maes

a. Where you can get it (if known)- http://www.datarescue.com/
b. Shareware/Freeware- Cost of standard edition is $439  This tool is worth the cost.
c.  What it does-  Disassembler and debugger with an assortment of community developed plug-ins. Supports a multitude of processors. Use a graphic interface. It allows you to step through malicious code. Best to run in a virtual machine with no network access.
d.  Tips for using it or gotchas-  
e.  Is the source of the tool considered trustworthy? 
f.   Screen Shots of the tool in action (optional)-
g.   Links to additional resource information about the tool-

7.  Holodeck:  Submitted by Vince Maes

a. Where you can get it (if known)- http://www.securityinnovation.com/holodeck/
b. Shareware/Freeware- Cost of single user license $1495.00
c.  What it does-  Basically a great fuzzing tool. Automated point-and-click fault scenarios, function call logging, operation intercepts, network packet logging, and a debugger just to name a few. There is a book by the developers that contains a light version of the product: How to Break Software Security.
d.  Tips for using it or gotchas-  
e.  Is the source of the tool considered trustworthy? 
f.   Screen Shots of the tool in action (optional)-
g.   Links to additional resource information about the tool-

WEBSITE LINKS:
1.  Pedram’s site:   http://pedram.redhive.com/   Submitted by  Vince Maes

Posted in HowTo's, Malware |