Pentest Malware

pentest-malware

Malware analiz advisory — static, dynamic, IOC, YARA. Aktif analiz icin izole sandbox zorunlu (production'da yapilmaz).

Triggers

• "malware analiz"
• "sample triage"
• "Cuckoo / VMRay sandbox"
• "IDA / Ghidra ile RE"
• "YARA imza yaz"
• "packer tespiti"
• "IOC extract"

Triage Akisi

1. Hash hesapla (SHA256)
2. VirusTotal sorgu (offline detection mevcut mu)
3. Strings + magic byte
4. Packer detection (PEiD, DIE)
5. Static disassembly (Ghidra/IDA)
6. Dynamic sandbox (Cuckoo, Any.run)
7. Network IOC (C2 domain, IP, JA3)
8. YARA imza yaz
9. Report

Hash + VT Lookup

# Hash
sha256sum sample.exe
md5sum sample.exe

# VT (API key gerekli, offline rapor)
curl -s "https://www.virustotal.com/api/v3/files/$(sha256sum sample.exe | cut -d' ' -f1)" \
  -H "x-apikey: $VT_KEY" | jq '.data.attributes'

# Onceki analiz hash uzerinden cikabilir -> dynamic kacir

Static Analiz

# File type
file sample.exe
file sample.bin

# Strings (ASCII + UTF-16)
strings -a -el sample.exe | grep -iE 'http|cmd|powershell|exec|reg|task'
strings sample.exe | grep -iE '\.exe$|\.dll$|\.bat$'

# PE header (Windows)
pefile.py sample.exe              # imports, exports, sections
peframe sample.exe                # high-level summary
DIE / Detect It Easy              # packer/protector detect

# ELF (Linux)
readelf -a sample.elf
objdump -d sample.elf | head

Packer Detect + Unpack

Dynamic Sandbox (Izole)

# Cuckoo (self-hosted)
cuckoo submit --machine win10-clean sample.exe
# Sonuc: behavior log, network capture, dropped files, registry changes

# REMnux (Linux analysis distro)
inetsim                          # fake internet (DNS, HTTP, SMTP)
oletools / olevba.py             # Office macro extract

IDA / Ghidra Workflow

1. Open sample.exe
2. Auto-analysis (Ghidra: 5-10 dakika)
3. Entry point (WinMain / main / DllMain)
4. Strings'i sec -> cross-reference
5. Suspicious imports: VirtualAlloc, CreateRemoteThread, WinExec
6. C2 hardcoded -> search "http://" "https://"
7. XOR decryption loops -> mark + decode
8. Anti-debug check: IsDebuggerPresent, PEB.BeingDebugged
9. Anti-VM check: registry keys, MAC prefix, CPU count
10. Behavior chain: file dropper -> persistence -> C2

YARA Imza Yazimi

rule Trickbot_Loader_v2 {
    meta:
        author = "Security Team"
        date = "2026-05-15"
        family = "Trickbot"
        description = "Trickbot loader version 2"
        reference = "https://malpedia.../trickbot"

    strings:
        $magic = { 4D 5A }                      // MZ header

        // Unique strings
        $s1 = "TrickBot" wide ascii
        $s2 = "GroupTag" wide
        $s3 = "ClientID" wide

        // Crypto routine signature
        $crypto = {
            8B 4D ?? 8B 55 ?? 33 D1 89 4D ??
            8B 55 ?? 81 EA 78 56 34 12
        }

        // C2 URL pattern
        $url = /https?:\/\/[a-z0-9]{8,16}\.(top|xyz|info)\/[a-z]{4,8}\.php/

    condition:
        $magic at 0
        and filesize < 500KB
        and (
            (2 of ($s*) and $crypto)
            or (1 of ($s*) and $url)
        )
}

IOC Output Sablonu

## Malware Analiz — sample_$(sha256).exe

### Triage
- SHA256: abc123def456...
- Family: Trickbot (v2)
- First seen: 2026-05-10 (VT)
- Detection rate: 23/72 AV

### Static
- PE, Win32, .NET (obfuscated with ConfuserEx)
- Packed: ConfuserEx -> de4dot ile unpack edildi
- Imports: VirtualAlloc, CreateRemoteThread, RegSetValueExA
- Strings: 5 URL, 3 user-agent, 2 service name

### Dynamic (sandbox)
- Dropper: %APPDATA%\Microsoft\<random>.exe
- Persistence: Registry Run + Scheduled Task
- C2: hxxps://malicious-domain[.]top/api.php
- Beacon: 60sn aralik, JA3 fingerprint cb02...

### IOC
| Type | Value |
|------|-------|
| SHA256 | abc123... |
| C2 Domain | malicious-domain.top |
| C2 IP | 203.0.113.45 |
| Mutex | Global\TrickBot_v2_1 |
| User-Agent | Mozilla/5.0 (compatible; MSIE 10.0; ...) |
| Reg Key | HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate |

Out-of-Scope

• Production malware unleash (sandbox zorunlu)
• Reverse engineering 3. taraf legitimate yazilim (lisans ihlali)
• 0-day exploit gelistirme