Resources list for malware hunters

-
Hey everyone,

In this post i'll try to group all different sources and "go-to" places that'll really help any malware analyst/hunter.

** Keep in mind that there are MANY other useful sources, and i'll be more than happy to update this list using your comments as well.


Let's dive straight into it: 


Honorable mentions

A few sources that really made a difference (at least for me)

Virusbay
A new sharing community for researchers , requires registration.
https://beta.virusbay.io/

Malpedia
The name says it all. 
Requires invitation and vouching.

Phrack
If you don't know it , you should.
CyberChef
It's everything, in one place.
https://gchq.github.io/CyberChef/

Tuts4You
Alot of exercises to practice on, and multiple tools and information sources
https://tuts4you.com/

Search Engines:

VirusTotal
I'll assume your'e all familiar with it.
A little tip - sometimes the virusTotal graph feature might be useful. 

ThreatMiner
Presents alot of useful info which contains info about samples, domains, hosts and email addresses.
Also provides very comfortable search options. 

Valkyrie
Another one i haven't checked much.

Shodan
IOT search-engine.

Sandboxes:

Detux (LINUX) - https://detux.org/index.php
Joe's sandbox - https://www.joesandbox.com/
ViCheck - https://vicheck.ca/

Trackers:

* Ransomware tracker - https://ransomwaretracker.abuse.ch/tracker/
* Malware corpus tracker - http://tracker.h3x.eu/families

Massive repositories:

VirusShare - https://virusshare.com/
malware.one - https://malware.one/


Blogs:

Krebs on security  - https://krebsonsecurity.com/
Security Affairs - http://securityaffairs.co/wordpress/
The hacker news - https://thehackernews.com/
Sucuri's blog - https://blog.sucuri.net/
GBHackers - https://gbhackers.com/


Some more technical blogs:

Vitali kremez's blog - http://www.vkremez.com/
Malwarebytes  - https://blog.malwarebytes.com/
Kaspersky's blog - https://securelist.com/
Malware unicorn's reversing guide - https://securedorg.github.io/RE101/ 
&&  https://securedorg.github.io/RE102/


Forums:

Malwaretips - https://malwaretips.com/ (has malware's samples)
Kernel mode - http://www.kernelmode.info/forum/
HackForums - https://hackforums.net/
Nulled - https://www.nulled.to/

Sources for Linux:

I mentioned a few links for linux before, but here's a more complete list that might be useful.
First of all, some info that might be important when your'e analyzing linux malware:

Useful commands
objdump (http://man7.org/linux/man-pages/man1/objdump.1.html)
readelf (https://sourceware.org/binutils/docs/binutils/readelf.html)
elfdump (https://docs.oracle.com/cd/E19683-01/816-0210/6m6nb7m8b/index.html)
nm (https://sourceware.org/binutils/docs/binutils/nm.html)
strace (http://man7.org/linux/man-pages/man1/strace.1.html)
ltrace (https://linux.die.net/man/1/ltrace)

Intro to ELF files

CheatSheets
* https://darkdust.net/files/GDB%20Cheat%20Sheet.pdf

REMnux
A great vm , you should check it out if your'e analyzing linux malware.
https://remnux.org/docs/


Sources for OSX:

Malware sources


Useful commands
dtruss (https://jameshfisher.com/2017/08/01/dtruss.html)
Syscalls info - https://sigsegv.pl/osx-bsd-syscalls/

Guides and overviews


Some additional interesting links:

YARA
* Online tool - https://analysis.yararules.com/

Cheat-sheets
* Reversing - http://r00ted.com/cheat%20sheet%20reverse%20v5.png
* Analyzing malware - https://zeltser.com/malware-analysis-cheat-sheet/
* Reversing - https://home.zcu.cz/~bodik/cheatsheets/reverse_engineering_cheat_sheet.pdf

Reference manuals
* https://github.com/rmusser01/Infosec_Reference
*  General guide - https://github.com/yellowbyte/reverse-engineering-reference-manual
* https://github.com/0x4D31/awesome-threat-detection
* https://github.com/wtsxDev/Malware-Analysis/


Tools
* https://www.kitploit.com/
* http://www.effecthacking.com/2017/10/maltrieve-tool-to-retrieve-malware-from-source.html (malware collection automation)
* https://github.com/microsoft/procdump-for-linux (analyzing malware on linux)
* https://github.com/decalage2/oletools/wiki (useful for office documents)
* ViperMonkey - http://decalage.info/vba_emulation (useful for office documents)

 Tools that make reversing easier (:
* the magic number data base - https://www.magnumdb.com/
* UUID database - https://uuid.pirate-server.com/

Ransomwares
A google doc that groups alot of different ransomwares.
https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml

Learning Resources:

While it's important to know how to find the interesting samples, it's also crucial to know how to dissect them (:
Here's some extra links to sharpen your knowledge. (notice that it doesn't aim to teach everything, for that there are great books and courses online).
I'll also make sure to share educational\interesting sources on twitter, you can find me at @B_H101

* vitali's technical blog is really helpful - http://www.vkremez.com/

* using wireshark effectively - https://hackertarget.com/wireshark-tutorial-and-cheat-sheet/

* setting up remote debugging with Windbg and IDA pro - https://research.checkpoint.com/scriptable-remote-debugging-windbg-ida-pro/




Final thoughts
When it comes to locating a sample, it really depends on what your'e after.

- If your'e interested in current threats, and "live" samples, it'll probably be best to keep on eye (or a script) on the latest feeds, and latest sandboxes submission's etc.

- If you're looking for more interesting and complicated samples, it might be better to keep an eye (or a script ?) on the latest papers in all different blogs and forums.

- YARA is a great direction when your'e dealing with mass amounts of samples, and it'll help you reducing the results into less duplicated sample , and divide them into specific "groups".

- Social communities (at least as i see it) is the best way to find/ask for "rare" samples and discuss them, and even get information or new data from fellow researchers.


If you have anything else to add to the list, please feel free to contact me.

Comments

Post a Comment

Popular posts from this blog

In MSDN we trust? - CreateRemoteThread Shenanigans

-
Image
Thanks for @Intel80x86 and @whtaguy for reviewing!   Disclaimer The following by no means presents any security issue or highly complex stuff. It’s merely a story of a short journey stretching from a driver debugging session to discovering just how wrong MSDN’s documentation can be. Motivation   As part of exercising writing different drivers, I wanted to see how removing the PROCESS_CREATE_THREAD access right from handles would affect the system, along with seeing just how effective this “aggressive” approach is when trying to block thread injections. No Access Rights Required   Why would it affect thread injection?  Well, apart from the self describing name of the access right, MSDN claims you need to pass a handle that has this access right when using CreateRemoteThread .     Figure 1: MSDN CreateRemoteThread handle parameter   Yet, my stupid simple thread injection PoC still worked after my driver removed that access right. Weird.  Maybe my driver has a bug?  Registering a post c
Read more

Revising Vulnerabilities - FTPShell 6.7 Client (Buffer Overflow)

-
Image
Big thx to @va_start for shaping up the writeup (; Short disclaimer The following writeup is a basic self-exercise of exploiting a known vulnerability that was already disclosed, there isn’t anything new here (: Goal While we know for sure there is a vulnerability from one of the most basic bug type classes (buffer overflow), the goal of this exercise is to attempt and find the overflow and exploit it ourselves.  Our vulnerable target is an FTP client which we’ll exploit from the server-side. The exploit scenario is unlikely as it would require a victim to connect to an attacker-controlled FTP server. Nonetheless it’s a great exercise. Intro Before diving into the client application and attempting to map its logic, we should start by making sure were familiar with the typical FTP protocol flow.  We won’t go over the details here, but you’re more than welcome to cover it quickly :) What’s important in our case are the following: The USER, PA
Read more