Locked Pinned All Malware Analyser Tools [Mega Collection]

goldregister · March 5, 2014

ApateDNS

This is the hidden content, please

ApateDNS is a tool for controlling DNS responses. Its interface is an

easy-to-use GUI. As a phony DNS server, ApateDNS spoofs DNS responses

to a user-specified IP address by listening on UDP port 53 on the local

machine. ApateDNS also automatically configures the local DNS server

to localhost. When you exit ApateDNS, it restores the original local DNS

settings. Use ApateDNS during dynamic analysis, as described in Chapter 3.

You can download ApateDNS for free from http://www'>http://www.mandiant.com/.'>

This is the hidden content, please

Autoruns

This is the hidden content, please

Autoruns is a utility with a long list of autostarting locations for Windows.

For persistence, malware often installs itself in a variety of locations,

including the registry, startup folder, and so on. Autoruns searches

various possible locations and reports to you in a GUI. Use Autoruns

for dynamic analysis to see where malware installed itself. You can

This is the hidden content, please

BinDiff

BinDiff is a powerful binary comparison plug-in for IDA Pro that allows

you to quickly compare malware variants. BinDiff lets you pinpoint new

functions in a given malware variant and tells you if any functions are

similar or missing. If the functions are similar, BinDiff indicates how similar

they are and compares the two. BinDiff will also guess at how similar the overall

binary is to one that you are comparing, though you must generate an

IDB file for both the original and the variant malware for this to work.

(If you have a fully labeled IDB file for the comparison, you will be able

to more easily recognize what is actually similar in the binary.)

BinDiff is available for purchase from http://www.zynamics.com/.'>http://www.zynamics.com/.

BinNavi

This is the hidden content, please

BinNavi is a reverse-engineering environment similar to IDA Pro. Its

strength lies in its graphical approach to reverse-engineering code. And,

unlike IDA Pro, BinNavi can centrally manage your previously analyzed

databases, which helps to track information; team members can easily

work on the same project and share information and findings. BinNavi

is available for purchase from http://www.zynamics.com/.

Bochs

This is the hidden content, please

Bochs is an open source debugger that simulates a complete x86 computer.

Bochs is most useful when you want to debug a short code snippet

in IDA Pro. IDA Pro supports a direct debugging mode of the IDB file

using Bochs. When debugging in this mode, the input file format isn’t

important—it can be a DLL, shellcode dump, or any other database that

contains x86 code. You can simply point to the code snippet and start

debugging. This approach is often useful when dealing with encoded

strings or configuration data. You can download Bochs for free from

This is the hidden content, please

A tutorial on installing and using Bochs in

IDA Pro can be found at

This is the hidden content, please

Burp Suite

This is the hidden content, please

The Burp Suite is typically used for testing web applications. It can be

configured to allow malware analysts to trap specific server requests and

responses in order to manipulate what is being delivered to a system.

When Burp is set up as a man-in-the-middle, you can modify HTTP or

HTTPS requests by changing the headers, data, and parameters sent by

the malware to a remote server in order to force the server to give you

portswigger.net/burp/

Capture BAT

Capture BAT is a dynamic analysis tool used to monitor malware as it

is running. Capture BAT will monitor the filesystem, registry, and process

activity. You can use exclusion lists (including many preset ones)

to remove the noise in order to focus on the malware you are analyzing.

While Capture BAT doesn’t have an extensive GUI like Process Monitor,

it’s open source, so you can modify it. You can download Capture BAT

for free from

This is the hidden content, please

CFF Explorer

This is the hidden content, please

CFF Explorer is a tool designed to make PE editing easy. The tool is useful

for editing resource sections, adding imports, or scanning for signatures.

CFF Explorer supports x86 and x64 systems, and it can handle

.NET files without having the .NET Framework installed. You can download

CFF Explorer for free from

This is the hidden content, please

Deep Freeze

This is the hidden content, please

Deep Freeze from Faronics is a useful tool to use when performing malware

analysis on physical hardware. It provides a VMware snapshotting

capability for real hardware. You can run your malware, analyze it, and

then just reboot. All the damage done by the malware will be undone,

and your system will be back to a clean state. Deep Freeze is available for

purchase from

This is the hidden content, please

Dependency Walker

This is the hidden content, please

Dependency Walker is a static analysis tool used to explore DLLs and

functions imported by a piece of malware. It works on both x86 and x64

binaries, and builds a hierarchical tree diagram of all DLLs that will be

loaded into memory when the malware is run. We discuss Dependency

Walker in Chapter 1. You can download it for free from http://www

.dependencywalker.com/.

Hex Editors

This is the hidden content, please

Hex editors allow you to edit and view files containing binary data. Many

hex editors are available, such as WinHex (our choice in this book), Hex

Workshop, 010 Editor, HexEdit, Hex Editor Neo, FileInsight, and Flex-

HEX. When choosing a hex editor, look for features like a solid GUI,

binary comparison, many data-decoding options (such as multibyte XOR),

a built-in hash calculator, file format parsing, pattern searching, and so

on. Many of these tools are available for purchase, but most come with a

trial version.

Hex-Rays Decompiler

This is the hidden content, please

The Hex-Rays Decompiler is a powerful, but expensive, plug-in for IDA

Pro that attempts to convert assembly code into human-readable, C-like

pseudocode text. This tool installs an F5 “cheat button.” When you are

looking at disassembly in IDA Pro, press F5 to have the plug-in open a

new window with the C code. Figure B-2 shows what the pseudocode

looks like for a code snippet from a piece of malware.

We find this plug-in particularly useful when trying to decipher difficult

encoding routines. In some cases, you can even copy and paste

the decompiler’s output and use it to write a decoding tool. Hex-Rays

Decompiler is the best tool on the market for decompiling, but it’s not

without its flaws. The Hex-Rays Decompiler is available for purchase

from http://www.hex-rays.com/.'>http://www.hex-rays.com/.

IDA Pro

This is the hidden content, please

IDA Pro is the most widely used disassembler for malware analysis. We

discuss IDA Pro extensively throughout the book, and Chapter 5 provides

an in-depth introduction to the tool. We recommend the commercial

version from http://www.hex-rays.com/. A freeware version is available

from http://www.hex-rays...._freeware.shtml.

Immunity Debugger

This is the hidden content, please

Immunity Debugger (ImmDbg) is a freely available user-mode debugger.

It is derived from the OllyDbg 1.1 source code, as we discuss in

Chapter 9, except that ImmDbg has cosmetically modified the OllyDbg

GUI and added a fully functional Python interpreter with an API. In

“Scriptable Debugging” on page 200 and the Chapter 13 labs, we demonstrate

how to use ImmDbg’s Python scripting ability. You can download

ImmDbg from

This is the hidden content, please

Import REConstructor

This is the hidden content, please

Import REConstructor (ImpREC) is a useful tool when you are manually

unpacking a piece of malware. The import address table (IAT) is often

damaged when you dump memory while unpacking, and you can use

ImpREC to repair the table. You provide the malware running in memory

and a dumped version on disk, and ImpREC does its best to repair

the binary. You can download ImpREC for free from

This is the hidden content, please

INetSim

INetSim is a Linux-based software suite for simulating common network

services that we find useful for dynamic analysis. Be sure to install it on a

Linux virtual machine, and set it up on the same virtual network as your

malware analysis Windows VM. INetSim can emulate many popular services,

such as a Microsoft Internet Information Services (IIS) web server,

and can even listen on all ports for incoming connections. We discuss

INetSim in Chapter 3. You can download it for free from http://www

.inetsim.org/.

LordPE

LordPE is a free tool for dumping an executable from memory. It allows

PE editing and can be used to repair a program you dumped from memory

using another method. LordPE is most commonly used for unpacking

malware. You can download it for free from

This is the hidden content, please

.com/collaborative/tools/index.php/LordPE.

Malcode Analyst Pack

The Malcode Analyst Pack contains a series of utilities, one of which

installs useful Windows shell extensions for strings, an MD5 hash calculator,

and a CHM decompile option. The CHM decompile option is

handy when dealing with malicious Windows help files. Also included is

FakeDNS, a useful tool for spoofing DNS responses to a user-specified

address. While these utilities are no longer officially supported, you

might still be able to download them from

This is the hidden content, please

software/download/?downloadID=8.

Memoryze

Memoryze is a free memory forensic tool that enables you to dump and

analyze live memory. You can use Memoryze to acquire all of live memory

or just individual processes, as well as to identify all modules loaded

on a given system, including drivers and kernel-level executables. Memoryze

also can detect rootkits and the hooks they install. If you choose to

use Memoryze, be sure to download Audit Viewer, a tool for visualizing

Memoryze’s output that makes the memory analysis process quicker and

more intuitive. Audit Viewer includes a malware rating index to help you

identify suspicious content in your memory dumps. You can download

Memoryze and Audit Viewer for free from http://www.mandiant.com/.

Netcat

This is the hidden content, please

Netcat, known as the “TCP/IP Swiss Army knife,” can be used to monitor

or start inbound and outbound connections. Netcat is most useful during

dynamic analysis for listening on ports that you know the malware

connects to, because Netcat prints all the data it receives to the screen

via standard output. We cover Netcat usage for dynamic analysis in Chapter

3 and also talk about how attackers use it in Chapter 11. Netcat is

installed by default in Cygwin and on most Linux distributions. You can

download the Windows version for free from

This is the hidden content, please

OfficeMalScanner

OfficeMalScanner is a free command-line tool for finding malicious

code in Microsoft Office documents. It locates shellcode, embedded PE

files, and OLE streams in Excel, Word, and PowerPoint documents, and

can decompress the newer format of Microsoft Office documents. We

recommend running OfficeMalScanner with the scan and brute options

on pre–Office 2007 documents and with the inflate option on post–

Office 2007 documents. You can download OfficeMalScanner from

This is the hidden content, please

OllyDbg

This is the hidden content, please

OllyDbg is one of the most widely used debuggers for malware analysis.

We discuss OllyDbg extensively throughout the book, and Chapter 9 provides

an in-depth introduction to the tool. OllyDbg is a user-mode x86

debugger with a GUI. Several plug-ins are available for OllyDbg, such as

OllyDump for use while unpacking (discussed in Chapter 18). You can

download OllyDbg for free from

This is the hidden content, please

PE Explorer

This is the hidden content, please

PE Explorer is a useful tool for viewing the PE header, sections, and

import/export tables. It is more powerful than PEview because it allows

you to edit structures. PE Explorer contains static unpackers for UPX-,

Upack-, and NsPack-compressed files. This unpacking feature is seamless

and saves a lot of time. You simply load the packed binary into PE

Explorer, and it automatically unpacks the file. You can download a trial

This is the hidden content, please

PEiD

This is the hidden content, please

PEiD is a free static analysis tool used for packer and compiler detection.

It includes more than 600 signatures for detecting packers, cryptors, and

compilers in PE format files. PEiD also has plug-ins available for download,

the most useful of which is Krypto ANALyzer (KANAL). KANAL

can be used to find common cryptographic algorithms in PE files and

provides the ability to export the information to IDA Pro. We discuss

PEiD in Chapters 1, 13, and 18. Although the PEiD project has been

This is the hidden content, please

Process Explorer

Process Explorer is a powerful task manager that is used in dynamic analysis

to provide insight into processes currently running on a system. Process

Explorer can show you the DLLs for individual processes, handles,

events, strings, and so on. We discuss Process Explorer in Chapter 3. You

can download Process Explorer as part of the Sysinternals Suite of tools

from http://www.sysinternals.com/.'>http://www.sysinternals.com/.

Process Hacker

This is the hidden content, please

Process Hacker is a powerful task manager similar to Process Explorer,

but with many added features. It can scan for strings and regular expressions

in memory, inject or unload a DLL, load a driver, create or start

processhacker.sourceforge.net/.

Resource Hacker

This is the hidden content, please

Resource Hacker is a useful static analysis utility for viewing, renaming,

modifying, adding, deleting, and extracting resources for PE-formatted

binaries. The tool works with both x86 and x64 architectures. Because

malware often extracts more malware, a DLL, or a driver from its resource

section at runtime, we find this tool useful for extracting those sections

easily without running the malware. We discuss Resource Hacker in

Chapter 1 and the Chapter 12 labs. You can download Resource Hacker

from

This is the hidden content, please

Sandboxes

In Chapter 3, we discuss the pluses and minuses of using sandboxes.

Many sandboxes are publicly available, and you can also write your own.

Public sandboxes are a decent choice because they are always being

developed in an effort to stay on top of the market. We demonstrate

GFI Sandbox in Chapter 3, but there are many others, including Joe

Sandbox, BitBlaze, Comodo, ThreatExpert, Anubis, Norman, Cuckoo,

Zero Wine, Buster Sandbox, and Minibis. As with hex editors, everyone

has a preference, so try a few to see what works for you.

Sandboxie and Buster Sandbox Analyzer

This is the hidden content, please

Sandboxie is a program that runs programs in an isolated environment

to prevent them from making permanent changes to your system. Sandboxie

was designed to allow secure web browsing, but its sandbox aspect

makes it useful for malware analysis. For example, you can use it to capture

filesystem and registry accesses of the program you are sandboxing.

Buster Sandbox Analyzer (BSA) can be used with Sandboxie to provide

automated analysis and reporting. Sandboxie and BSA can be downloaded

from

This is the hidden content, please

and

This is the hidden content, please

Snort

Snort is the most popular open source network intrusion detection system

(IDS). We discuss writing network-based signatures for Snort in

Chapter 14. Snort can be run actively or offline against packet captures.

If you write network signatures for malware, using Snort to test them is a

good place to start. You can download Snort from

This is the hidden content, please

Strings

Strings is a useful static analysis tool for examining ASCII and Unicode

strings in binary data. Using Strings is often a quick way to get a highlevel

overview of malware capability, but the program’s usefulness can be

thwarted by packing and string obfuscation. We discuss Strings in Chapter

1. You can download Strings as part of the Sysinternals Suite of tools

from http://www.sysinternals.com/.

~~fudmario~~ · March 5, 2014

Re: All Malware Analyser Tools [Mega Collection]

Excelente Coleccion goldregister, tenia pensado postar algo similar :big_boss:

Saludos.

Sign In

Locked Pinned All Malware Analyser Tools [Mega Collection]

Recommended Posts

goldregister

Link to comment

Share on other sites

fudmario

Link to comment

Share on other sites

Browse

Activity

Store

Important Information