kscz0000 文件识别
file sample.exe sha256sum sample.exe
字符串提取
strings -a sample.exe | head -100 FLOSS sample.exe # 混淆字符串
加壳检测
diec sample.exe # Detect It Easy exeinfope sample.exe
导入表分析
rabin2 -i sample.exe dumpbin /imports sample.exe
### 阶段3：静态分析
1. **加载到反汇编器**：IDA Pro、Ghidra 或 Binary Ninja
2. **识别主要功能**：入口点、WinMain、DllMain
3. **映射执行流**：关键决策点、循环
4. **识别能力**：网络、文件、注册表、进程操作
5. **提取IOC**：C2地址、文件路径、互斥体名称
### 阶段4：动态分析
环境搭建：
- 安装常用软件的 Windows 虚拟机
- Process Monitor、Wireshark、Regshot
- API Monitor 或带日志的 x64dbg
- INetSim 或 FakeNet 用于网络模拟
执行：
- 启动监控工具
- 执行样本
- 观察5-10分钟行为
- 触发功能（连接网络等）
记录：
- 尝试的网络连接
- 创建/修改的文件
- 注册表变更
- 衍生进程
- 持久化机制
## 使用场景
- 涉及恶意软件分析相关任务或工作流时
- 需要恶意软件分析的指导、最佳实践或检查清单时
## 不适用场景
- 任务与恶意软件分析无关
- 需要本范围之外的其他领域或工具
## 使用说明
- 明确目标、约束和所需输入。
- 应用相关最佳实践并验证结果。
- 提供可操作步骤和验证方法。
- 如需详细示例，打开 `resources/implementation-playbook.md`。
## 常见恶意软件技术
### 持久化机制
Registry Run keys - HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run Scheduled tasks - schtasks, Task Scheduler Services - CreateService, sc.exe WMI subscriptions - Event subscriptions for execution DLL hijacking - Plant DLLs in search path COM hijacking - Registry CLSID modifications Startup folder - %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup Boot records - MBR/VBR modification
### 规避技术
Anti-VM - CPUID, registry checks, timing Anti-debugging - IsDebuggerPresent, NtQueryInformationProcess Anti-sandbox - Sleep acceleration detection, mouse movement Packing - UPX, Themida, VMProtect, custom packers Obfuscation - String encryption, control flow flattening Process hollowing - Inject into legitimate process Living-off-the-land - Use built-in tools (PowerShell, certutil)
### C2通信
HTTP/HTTPS - Web traffic to blend in DNS tunneling - Data exfil via DNS queries Domain generation - DGA for resilient C2 Fast flux - Rapidly changing DNS Tor/I2P - Anonymity networks Social media - Twitter, Pastebin as C2 channels Cloud services - Legitimate services as C2
## 工具熟练度
### 分析平台
Cuckoo Sandbox - Open-source automated analysis ANY.RUN - Interactive cloud sandbox Hybrid Analysis - VirusTotal alternative Joe Sandbox - Enterprise sandbox solution CAPE - Cuckoo fork with enhancements
### 监控工具
Process Monitor - File, registry, process activity Process Hacker - Advanced process management Wireshark - Network packet capture API Monitor - Win32 API call logging Regshot - Registry change comparison
### 脱壳工具
Unipacker - Automated unpacking framework x64dbg + plugins - Scylla for IAT reconstruction OllyDumpEx - Memory dump and rebuild PE-sieve - Detect hollowed processes UPX - For UPX-packed samples
## IOC提取
### 需提取的指标
```yaml
Network:
- IP addresses (C2 servers)
- Domain names
- URLs
- User-Agent strings
- JA3/JA3S fingerprints
File System:
- File paths created
- File hashes (MD5, SHA1, SHA256)
- File names
- Mutex names
Registry:
- Registry keys modified
- Persistence locations
Process:
- Process names
- Command line arguments
- Injected processes
YARA规则
rule Malware_Generic_Packer
{
meta:
description = "Detects common packer characteristics"
author = "Security Analyst"
strings:
$mz = { 4D 5A }
$upx = "UPX!" ascii
$section = ".packed" ascii
condition:
$mz at 0 and ($upx or $section)
}
报告框架
分析报告结构
# Malware Analysis Report
## Executive Summary
- Sample identification
- Key findings
- Threat level assessment
## Sample Information
- Hashes (MD5, SHA1, SHA256)
- File type and size
- Compilation timestamp
- Packer information
## Static Analysis
- Imports and exports
- Strings of interest
- Code analysis findings
## Dynamic Analysis
- Execution behavior
- Network activity
- Persistence mechanisms
- Evasion techniques
## Indicators of Compromise
- Network IOCs
- File system IOCs
- Registry IOCs
## Recommendations
- Detection rules
- Mitigation steps
- Remediation guidance
伦理准则
适当用途
- 应急响应和取证
- 威胁情报研究
- 安全产品开发
- 学术研究
- CTF竞赛
禁止协助
- 创建或分发恶意软件
- 未经授权攻击系统
- 恶意规避安全产品
- 搭建僵尸网络或C2基础设施
- 未经授权的任何攻击性操作
响应方法
- 验证上下文：确保防御/授权目的
- 评估样本：快速分类，了解样本类型
- 推荐方法：选择适当的分析方法
- 引导分析：带安全考虑的分步指导
- 提取价值：IOC、检测规则、行为理解
- 记录发现：面向利益相关方的清晰报告
限制
- 仅在任务明确匹配上述范围时使用本技能。
- 输出不能替代针对具体环境的验证、测试或专家审查。
- 若缺少必要输入、权限、安全边界或成功标准，应停下来请求澄清。