Blue Teaming pt. 1: Static Malware Analysis 101
What is Static Malware Analysis?
Static malware analysis is when you attempt to learn about a malicious program without letting it run. This could be to gain some insight as to how it runs to be used in dynamic analysis later.
Handling Malware Safely:
When analysing malware, the most important thing (in my opinion at least) is to keep your network safe. If you detect malware on your network and manage to isolate it, the last thing you want is to re-release it.
I would recommend having a separate machine used just for malware analysis to avoid data theft on your main device. You could use a physical computer for this, but that could be expensive. A dedicated virtual machine is perfectly sufficient for this (If you don’t know how to set up a VM, you can read my guides on using VirtualBox and VMware).
When dealing with malware it is a good idea to isolate the machine. This stops the malware from spreading to other devices. This could be done by either disconnecting the machine from the network (via disabling the network adapter) or, if the machine requires some form of network access, putting it on a virtual LAN segment.
To conclude: Have a dedicated device (preferably a VM) and disable the network adapter to isolate the machine when you start handling the malware. Once you have safely set up your machine you can download a sample from my GitHub, which can be unzipped with the password “infected”.
Detecting a Malware:
We know that what we just downloaded is malicious, but let’s pretend we don’t. An antivirus program is a good indicator of if a file is malicious or not, but they have their limitations: namely that they can’t detect malware with 100% efficiently. To get a more accurate idea of if a file is malware or not we will need multiple antivirus programs. Enter VirusTotal. This website runs any file you upload to it through multiple different antivirus and reports if they find the software suspicious.
When I run the sample through VirusTotal, I get output like so:
Not every AV detected the sample, however over half of them did. This is enough to decide fairly conclusively that the file is malicious.
VirusTotal also has a feature where you can search with a hash of a file. You can use either MD5 (which can be found with the command ‘md5sum [filename]’) or SHA256 (‘sha256sum [filename]’)
After getting the hash of the file, you can search for it in VirusTotal. Since the hash and the file you uploaded mean the same thing, the results will be identical.
When you search on VirusTotal, the website automatically converts the search to a SHA256 hash. This is why you can upload a file or different types of hashes.
Static Analysis
VirusTotal also gives you more information than whether a file is malicious. In the ‘Behaviour’ tab you can see information on the malware such as what domains/IP addresses it tried to reach, as well as any files it modifies. As a Blue-Teamer you can block the domains that it talks to from being accessed on your network, and also look for files that it leaves behind to tell if the malware has run.
We can see that the trickbot sample downloads a file from soberlifeco[dot]com. We can also see that it makes a TCP request to an IP address (This corresponds to the domain found, but it may be useful to know both). Needless to say, you probably shouldn’t go to this domain unless you know what you are doing and can do so safely.
Up to recently we’ve been relying on another service for our analysis, but what if we want to do some ourselves? Maybe we’ve found a file which isn’t on VirusTotal, or maybe we want to verify the findings for ourselves. A simple tool I found for reverse engineering is the ‘strings’ command. This command searches through the file you pass to it and outputs what it thinks might be human-readable text. When we run ‘strings’ on trickbot.xls, we get output like this:
It is important to remember that what is readable for a human is not for a computer and vice versa, so most output from a ‘string’ command isn’t useful however if we look through, we can see the URL we found on VirusTotal:
It’s been broken up by another bit of text, but on one line you can see “http://” indicating the protocol to use, and then two lines later is the rest of the domain (“soberlifeco[dot]com”) and the path to the file that our sample downloads.
Conclusion:
By no means is this an exhaustive wealth of knowledge on static malware analysis, but I hope it will be a useful introduction. Recently I’ve been doing some Capture the Flag competitions and I’ve found that this has been enough to get me started on the subject.
Remember the most important part: keep your network safe. The last thing you need is for the malware to spread. Sites like VirusTotal will probably have enough information, but if not, you know how to begin searching for information without running the malware
