>> Hi, welcome to the Cybrary.
My name is Sean Pierce.
I'm subject matter expert from malware analysis.
Today we will be covering Part 2 of
basic dynamic analysis where
we'll be looking at networking.
Just a quick recap of what we covered last time.
We talked about what dynamic analysis is,
which is just basically dropping
>> a piece of malware into
>> a VM and just executing it and seeing what it does.
Like I said, this is very fast, it's easy.
But there is a drawback where code may
not execute for a great many number of reasons.
Like it's VM-aware or is past a certain date
or you just don't
trigger that functionality because
the environment is not right,
like you don't have a certain piece
of software or something like that.
It's easy to generate indicators of compromise,
like path names or
file hashes from files that are dropped by the malware.
But it's a little more difficult for
other kinds of indicators like attribution.
That's where the human element comes into play
because there are plenty of sandboxes out there,
plenty use of malware analysis platforms,
but they can't really tell you attribution,
they can't really tell you risk
or impact to your business or organization.
That's really why you need a human malware analyst
to do this stuff.
Today we're going to be looking at indicators of
compromise on the network level,
which I think is very important because most malware,
every piece of malware I've ever
seen in the real world has always had
some network presence
>> where it either spreads via network
>> or communicates with its command and control
server over the network.
There are some tricky things out there
that use like peer-to-peer or
that uses tour or
an IRC chat room or something like that.
But most of the time it's going
>> to use a simple website,
>> a domain name most like
update hairdresser.com or something like that.
The command and control server will
be up for a little while over here,
then they'll change
the domain endpoint to somewhere else.
It's really easy to pick that stuff out, pretty fast,
and we're going to see an example of how we would do
that with our current environment
that we have set up before.
As I said, indicators
of compromise or what you're really after.
There's plenty of those file hashes,
strings, path names, process names, registry keys.
Since we are going to be talking about networking,
mainly we are going to be after
domain names, IP addresses.
Network traffic is pretty important if it's encrypted,
if it's easy to
decrypt because some malware
has very lousy encryption that
we can break pretty trivially.
There are other malware we cannot break
trivially or they use HTTPS or something like that.
In which case it would be a pain to get at.
Really, if all we
want is an indicator that someone is infected,
we don't necessarily need to break
the crypto or get at the information inside
because usually is some beacon to
the command and control server with
basic information of the compromised host.
Like username, IP address, both internal address,
an external address, or time or date of the infection,
usually a campaign code.
The botnet herders know what
campaigns are most effective at infecting
people like via exploit kit,
a spam, or some other method.
We saw some network traffic and we're able
to make some indicators of compromise, some IoCs.
There are a few ways in
which we can standardize this format.
OpenIoC, made by
Mandiant is an interesting project where they
have gone though the trouble of categorizing
tons and tons of indicators.
Here's some basic ones I just throw up on the screen,
like process name, file strings,
file owner, your file path,
eventlog ID, file name,
file hash, file MD5.
These things aren't always fantastic indicator,
but when combined, they can be quite effective.
Like filename doesn't really
mean a whole lot because any file
can change its name
or any file can have any name pretty much.
Except if we know
this particular filename is
only used by this one piece of malware or
this one version of a piece of malware,
that can help us identify stuff pretty quickly.
They keep some public information
about indicators that they
have for all the common malware families.
They use these indicators to scan
files on a computer or scan their holdings,
their malware repos or whatever else.
It is quite helpful, they're easy to make.
I would like to point out that this is
not an antivirus solution.
You shouldn't just go grab a whole bunch
of indicators or some openIoC files,
and scan your computer and say,
"Oh, look at this file right
here has an openIoC alert of new Zeus."
It's like, wow. There's a string in
the file that triggered this, but that's benign.
It's not an antivirus signature.
It's really just to help defenders of networks
communicate threat data to
each other in a standardized format.
I've seen some products
on the market start to support openIoC.
But it's not very common and it's a great idea,
but it's not currently implemented.
What's far more implemented is Yara.
Yara is very simple.
It is basically what it looks like,
where you can describe a few things.
With openIoC, you can do
>> lots of things, tons of things.
>> With the Yara, it's more of here's this,
whose hashes is this?
Metadata file name could be this.
Strings might be A or B or
C. Down at the bottom
you see there's a little condition part,
where it's A or B or C,
and you can actually make some complicated logic or
it's A and B or
C. It's like A and or B or
C. This is far more implemented,
but it is not an antivirus solution either.
It's important to note that this is
useful and it is supported by lots of things,
but not very well.
Some platforms search your signatures and
memory 1,000 times faster than other platforms.
But their detections aren't
very good because they have sloppy programming.
It's just important to know that this is how one would
communicate threat data in
>> the real world between groups,
>> like intelligence groups or network defense groups or
hunt teams or malware analyst teams
or network defender teams.
But it may not suit you in your enterprise.
You should test this stuff.
Just to recap of what we covered today.
We covered indicators of compromise.
We covered some of their standards in the industry.
I mentioned two major ones,
which is openIoC and Yara.
We demonstrate basic dynamic analysis
looking for network indicators.
I want to show you three web pages I think will be
very useful to you and here they are.
The first one is a GitHub page
with a lot of excellent malware analysis tools.
In particular, the network segment
has some pretty good tools.
I recognized them all and I
would suggest that you familiarize yourself with them.
Maybe not taking a whole day per tool,
but you should at least click through some demo videos.
Another good website is malware-analyzer.com,
and they list a good number of tools.
Same, this is what we use today.
Ncat is different than Netcat.
Netcat is NC and is a traditional Linux tool,
Ncat is the upgrade.
The third site is this opensecuritytraining.info,
that's put on by [inaudible] and it is fantastic.
They have hands-on online learning labs
and they have lots of
samples and they have
really smart people working for them.
It's really something you should invest a whole week or
two because they go pretty in-depth.
It's good but I've never made
it more than a few days through all of this stuff.
They use the same book that I've suggested before.
Thank you for watching
this Cybrary video. Hope to see you again.