Session_9_Malware Analysis using pymal & malpimp.pdf

(153 KB) Pobierz
(C) SecurityXploded Research Group
Advanced Malware Analysis Training
MALWARE ANALYSIS USING PYMAL &
MALPIMP
Amit Malik
Idiot @SecurityXploded Research Group
Researcher @Fireeye Labs
(C) SecurityXploded Research Group
Advanced Malware Analysis Training
Agenda
• 
Tools introduction
• 
Malpimp
• 
Configuration file
• 
Tracing
• 
Demo
• 
Pymal
• 
Features and functions
• 
Demo
• 
More examples
(C) SecurityXploded Research Group
Advanced Malware Analysis Training
Tools Introduction
• 
Malpimp – based on pydbg (pure python debugger)
• 
API tracing, using configuration file you can configure the tool according to your needs.
• 
Light weight and very easy, just serves the purpose
• 
PyMal – Python interactive shell for malware analysis
• 
Based on three powerful pure python tools: pefile, pydbg, volatility
• 
Pydbg != debugger in pymal
• 
Process manipulation & live memory analysis.
• 
Some powerful features like hook detection (proprietary), Injected code detection.
• 
And full python support
J
(C) SecurityXploded Research Group
Advanced Malware Analysis Training
Malpimp
• 
Second argument on command line is the address from where we want to start tracing. Zero means entry point.
• 
Configuration file
• 
Fine control over tracing
• 
Loop detection based on return address – believe me this is really a beautiful feature, I saw couple of big
heavy commercial products that are suffering on it. Also this technique is unique to this tool and it greatly
improves the tracing time. [Depending on your configs it is capable to reduce tracing time from 2 hours to 2
seconds with almost same information.]
• 
Inclusion and exclusion policies
(C) SecurityXploded Research Group
Advanced Malware Analysis Training
Malpimp Configuration
• 
TraceInclude – Apply hooks only on these DLLs or APIs, if this field have some value either in DLL
or API then TraceExclude will be ignored.
• 
Syntax : for DLL: simple dll name like : kernel32.dll, user32.dll etc. , for API: DLL!API name e.g: kernel32!VirtualAlloc
• 
TraceExclude works only when we have all fields empty in TraceInclude policy.

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin