5 ms·

I'm not an infosec professional, but I'm curious to poke around some of these samples. Any recommendations for good hygiene when manipulating this stuff?

hirako2000 6y ago
Just a sandboxed virtual machine.
- data_spy 6y ago
  That's smart, I'd probably just play with it on my computer, since testing code in production is my life's motto.
- Nextgrid 6y ago
  This would be fine for basic malware but the most exciting stuff (what is most likely to be of interest to an analyst) is more likely to contain VM-escape exploits and strategies.
elorant 6y ago
Depending on your level or paranoia I wouldn't touch those only in a separate computer. I don't think a VM is sufficient, there have been reports about malware that can break out of a sandboxed environment.
- dx87 6y ago
  A separate computer would also be good because some malware won't run in a VM since the developer knows it's probably getting analyzed.
thomasdub 6y ago
This is quite dangerous unless you know what you’re doing, if you execute the malware then plan to throw away all equipment you’re using to analyze it. For a next-best experience, if you’re curious, you should upload one to an online malware sandbox e.g. app.any.run which allows you interact with it, look at network traffic, inspect file mods etc. - all the fun, much much less risk and hassle!
- arsome 6y ago
  Be careful if you're trusting any of those sandbox services for accurate results though - some malware is able to detect the VM they're running in and refuse to run the malicious payload. Often times legitimate cracks will be distributed on sources like Usenet using a "binder" to attach the malicious payload the an otherwise perfectly fine crack. As a side note, for some reason, there's way more malware on usenet than bittorrent, I've even found it on games on major NZB sites, possibly just due to the seed counts weeding out the malicious ones via simple popularity in the public bittorrent world.
- voltagex_ 6y ago
  > if you execute the malware then plan to throw away all equipment you’re using to analyze it I'm not sure your run of the mill malware is doing anything that can't be fixed by a format and reinstall, but yes, use an isolated VM.
- secfirstmd 6y ago
  Cuckoo Sandbox is a decent self hosted tool for analysing malware. Though a complete pain to setup. Even with some of the scripts making parts of it easier.
arsome 6y ago
If you're just playing with script kiddie stuff and not ridiculous zero days, an up to date virtual machine should be just fine, make sure to keep your VM up to date. VM breaking malware is actually quite rare and usually patched quickly - this is the same stuff that keeps cloud providers safe where anyone can execute arbitrary code in a VM on their systems, if it's good enough for them, it's probably good enough for you, just make sure it has no access to your network. VM detecting malware however is exceedingly common: plan to have to bypass basic VM detection, minimal knowledge of reverse engineering should make that pretty easy. If you want/need to allow it access to the internet for dynamic analysis or botnet monitoring, I'd suggest looking into setting up a separate VM to route all the traffic over Tor or a commercial VPN provider and allowing it access only via that VM. This way if you manage to piss off any script kiddies you won't be the one who gets DDoS'd. Nothing is perfect and if you're serious about this consider separate hardware, but if you're not quite that paranoid this setup is highly workable.
- Bnshsysjab 6y ago
  If you wanna go a little bit more paranoid, use a dedicated host to virtualise those machines and connect to the host via RDP/whatever, that should create another layer of safety.
  - R0b0t1 6y ago
    You may want to connect via a VM, there is a CVE for remote execution in FreeRDP from compromised server. In general anything doing video, image, or audio decompression should be an assumed vector.
    - Bnshsysjab 6y ago
      That’s a fair point.
- Bnshsysjab 6y ago
  As a side note, and I’ll create a separate thread: say my host is comprised by super sophisticated malware, aside from a reformat what other sanitisation practices can I do? Can I ever trust the hardware again? I don’t think we’re at a point where a firmware compromised graphics card can’t reinfect the processor?
stellersjay 6y ago
I have done a fair bit of reverse engineering to date including malware analysis. Havent read all the comments but of course a safe environment is important. Virtual environments can even be broken out of if you dont know how to debug simple samples that check for disassemblers or debugger presence. I recommend if you want to get some hands on experience checkout https://nostarch.com/malware https://nostarch.com/malware (Practical Malware analysis) it will prepare you for messing with real life samples. Techniques are still relevant but technology might be different. Eg: IDA is great but Ghirda is the new hotness on the street. Anyways have fun, good luck and be safe. Most of all happy hacking :)
- phaus 6y ago
  >IDA is great but Ghirda is the new hotness on the street. Ghidra is great but its got a long uphill battle before it dethrones IDA as the choice of professional malware analysts.
  - stellersjay 6y ago
    I agree. I am still a IDA user myself but dabble with other tools in the field to see what competitive edge they may have to offer. What ever gets the job done :)

hirako2000 6y ago

Just a sandboxed virtual machine.

data_spy 6y ago
That's smart, I'd probably just play with it on my computer, since testing code in production is my life's motto.
Nextgrid 6y ago
This would be fine for basic malware but the most exciting stuff (what is most likely to be of interest to an analyst) is more likely to contain VM-escape exploits and strategies.

elorant 6y ago

Depending on your level or paranoia I wouldn't touch those only in a separate computer. I don't think a VM is sufficient, there have been reports about malware that can break out of a sandboxed environment.

dx87 6y ago
A separate computer would also be good because some malware won't run in a VM since the developer knows it's probably getting analyzed.

thomasdub 6y ago

This is quite dangerous unless you know what you’re doing, if you execute the malware then plan to throw away all equipment you’re using to analyze it. For a next-best experience, if you’re curious, you should upload one to an online malware sandbox e.g. app.any.run which allows you interact with it, look at network traffic, inspect file mods etc. - all the fun, much much less risk and hassle!

arsome 6y ago
Be careful if you're trusting any of those sandbox services for accurate results though - some malware is able to detect the VM they're running in and refuse to run the malicious payload. Often times legitimate cracks will be distributed on sources like Usenet using a "binder" to attach the malicious payload the an otherwise perfectly fine crack. As a side note, for some reason, there's way more malware on usenet than bittorrent, I've even found it on games on major NZB sites, possibly just due to the seed counts weeding out the malicious ones via simple popularity in the public bittorrent world.
voltagex_ 6y ago
> if you execute the malware then plan to throw away all equipment you’re using to analyze it I'm not sure your run of the mill malware is doing anything that can't be fixed by a format and reinstall, but yes, use an isolated VM.
secfirstmd 6y ago
Cuckoo Sandbox is a decent self hosted tool for analysing malware. Though a complete pain to setup. Even with some of the scripts making parts of it easier.

arsome 6y ago

If you're just playing with script kiddie stuff and not ridiculous zero days, an up to date virtual machine should be just fine, make sure to keep your VM up to date. VM breaking malware is actually quite rare and usually patched quickly - this is the same stuff that keeps cloud providers safe where anyone can execute arbitrary code in a VM on their systems, if it's good enough for them, it's probably good enough for you, just make sure it has no access to your network. VM detecting malware however is exceedingly common: plan to have to bypass basic VM detection, minimal knowledge of reverse engineering should make that pretty easy. If you want/need to allow it access to the internet for dynamic analysis or botnet monitoring, I'd suggest looking into setting up a separate VM to route all the traffic over Tor or a commercial VPN provider and allowing it access only via that VM. This way if you manage to piss off any script kiddies you won't be the one who gets DDoS'd. Nothing is perfect and if you're serious about this consider separate hardware, but if you're not quite that paranoid this setup is highly workable.

Bnshsysjab 6y ago
If you wanna go a little bit more paranoid, use a dedicated host to virtualise those machines and connect to the host via RDP/whatever, that should create another layer of safety.
- R0b0t1 6y ago
  You may want to connect via a VM, there is a CVE for remote execution in FreeRDP from compromised server. In general anything doing video, image, or audio decompression should be an assumed vector.
  - Bnshsysjab 6y ago
    That’s a fair point.
Bnshsysjab 6y ago
As a side note, and I’ll create a separate thread: say my host is comprised by super sophisticated malware, aside from a reformat what other sanitisation practices can I do? Can I ever trust the hardware again? I don’t think we’re at a point where a firmware compromised graphics card can’t reinfect the processor?

stellersjay 6y ago

I have done a fair bit of reverse engineering to date including malware analysis. Havent read all the comments but of course a safe environment is important. Virtual environments can even be broken out of if you dont know how to debug simple samples that check for disassemblers or debugger presence. I recommend if you want to get some hands on experience checkout https://nostarch.com/malware https://nostarch.com/malware (Practical Malware analysis) it will prepare you for messing with real life samples. Techniques are still relevant but technology might be different. Eg: IDA is great but Ghirda is the new hotness on the street. Anyways have fun, good luck and be safe. Most of all happy hacking :)

phaus 6y ago
>IDA is great but Ghirda is the new hotness on the street. Ghidra is great but its got a long uphill battle before it dethrones IDA as the choice of professional malware analysts.
- stellersjay 6y ago
  I agree. I am still a IDA user myself but dabble with other tools in the field to see what competitive edge they may have to offer. What ever gets the job done :)