In this lecture we will introduce reverse engineering malware using Ghidra.
So by using Ghidra, you will be able to analyze executable binary files containing malicious code.
This section is a great opportunity to put into practice the knowledge acquired during the first sections
of our course and to put this knowledge into practice.
We will analyze the point of sale POS malware.
So this malware basically scrapes the Ram memory of point of sale systems to steal credit card and debit
card information.
So here we will first research about the point of sale malware.
Let's open the Google Chrome here and point of sale.
Malware.
And as you can see here, malware is a type of malicious software designed to steal a customer's personal
information through the point of sale devices, POS devices.
Let's see what POS devices.
And here this is the post device here.
So this malware is designed for this post devices.
So here I have two files.
In the first file we have the malware and s y.
S file, which you will learn what this is used for.
And after that we have the password for this zip file.
So before installing this malware, before you actually you need to run this malware on sandbox or virtual
machine because it might infect your main machine here.
So firstly, turn off the real time protection.
So this is a executable Windows malware and here our approach will start by setting a safe analysis
environment, of course, and then we will look for malware indicators in the malware sample.
And finally, we will conclude by performing in-depth malware analysis using ghidra.
So here for technical requirements, you will need to have the virtual machine like virtual box here.
In previous lectures you learned how to install the virtual machines into your.
Operating system.
And also you will need to download the samples which is attached to the lecture section here.
And at the time of creating this course, the public version of Ghidra has no debugging support for
now, so this limits the scope of Ghidra to static analysis, meaning files are analyzed without being
executed.
So.
But of course Ghidra static analysis can complement the dynamic analysis performed by any existing debugger
of your choice, such as x64, dbg, Windbg and Ollydbg.
So both types of analysis can be performed in parallel.
So setting up an environment for malware analysis is a broad topic, So we will cover the basics of
ghidra for this purposes.
And keep in mind that the Golden Rule when setting up a malware analysis environment is to isolate it
from your computer and network.
Even if you are performing static analysis, it is recommended to set up an isolated environment because
you have no guarantee that malware won't exploit some ghidra vulnerability and get executed anyway.
Because here you also has some vulnerabilities.
It should be like Siva does.
1917 664.
And here this is a ghidra malware.
So CVA 20, 1917 664 is when executing data from a given path.
The Java Process Working Directory is set to this path.
So then when launching the Python interpreter via the Ghidra code browser window, Python Ghidra will
try to execute the cmd dot exe program from this working directory here.
So as you can see here, the base store score is high here.
And in order to analyze malware, you can use physical computer restorable to a client state via hard
disk drive backups or virtual one here.
So the first option is more realistic but slower when restoring the backup and more expensive here.
So you can also isolate your network.
This is a good example to illustrate risk.
This is ransomware encrypting the shared folders during analysis.
So you can also use the VirtualBox or VMware.
For your creating virtual machine purposes.
And now let's look into our malware here.
So as you probably remember from previous lectures, GitLab works with projects containing zero or more
files.
So this here, this malware consists of two components.
So actually, let's call this the cleaner.
Malware, because in reality, actually this malware called by the Internet community.
Is Lena here the code name?
So Lena malware here consists two components.
Can you see the screen?
Yes.
Perfect.
So the malware here contains consists of two components a Windows driver, r, t, dot c.
S and a portable executable Sparc dot x.
So there are a compressed data project like this here.
Malware sample one dot zip containing both components can be found in the lecture attachment section.
So if you want to get the linear malware sample as is instead of Ghidra project, you can also find
it in the lecture attachment sections here.
And because we also compressed and protected with the password infected, we also have this file.
So the password is infected and it's quite common to share malware in this way so that it does not accidentally
get infected.
And next we will try to quickly guess what kind of malware we are dealing with in general terms.
And to do that, we will look for strings which can be revealing in many cases.
So we will also check external sources which can be useful if the malware has been analyzed or classified.
So finally, we will analyze its capabilities by looking for dynamic linking library DLL functions.
So here the functions and we have the C and exec here.
So now what we're going to do is we will start a draw here.
The new project.
And after that we will start analysis in next lecture.
I'm waiting you in the next lecture.