What are the best tools and techniques for malware reverse engineering? (2024)

Key takeaways from this article

• Comprehensive static analysis:

  Starting with malware metadata and strings can provide quick insights. As you progress, use disassemblers for a deeper dive into the code, gaining knowledge on functionality without risking execution.

• Tailor your toolkit:

  Select analysis tools based on factors like operating system, architecture, and programming language of the malware. This targeted approach ensures you have the right resources for thorough investigation and saves time.

This summary is powered by AI and these experts

• Gaurav Sarraf Security Engineer @ Lumen Technologies…
• Elsayed Elrefaei Incident Response Engineer @Kaspersky |…

• Gaurav Sarraf Security Engineer @ Lumen Technologies | CKA | CKS | CPENT | CCNA | CEH | AZ900 | AZ500 | OWASP LLM Top 10

  • Report contribution
  One can just begin by examining the malware's metadata and strings to glean initial insights. They then use disassemblers and decompilers to break down the binary into readable assembly or high-level code, allowing for a deeper understanding of the malware's functionality. Tools like hex editors and debuggers are employed throughout the process to inspect the binary's raw data and evaluate code structure without execution.

  Like

  4

• Elsayed Elrefaei Incident Response Engineer @Kaspersky | GREM

  • Report contribution
  Malware analysis process could be a complicated process, selection of the appropriate tools will be based on several factorsfor example1.Operating system:are you analyzing malware for windows,mac,linux,or android?2.Architecture:suppose you are in window,is it 32bit or 64bit3.Language :written in a native language like C/C++ hybrid one like java.After determine these factors, you should know that the purpose of any static analysis process is to gain more knowledge about the malware before starting the deep analysis, you should know what is the language of this malware,is it packed or not.is it obfuscated or not.tools1.CAPA : to show the malware capabilities based on its imported apis2. Strings/FLOSS3. DIE 4. Pebear IDA Pro/ghidra

  Like

  4

• Bruno Santos Security Engineer | Cyber Defense | Endpoint Protection | Sentinel SIEM | Digital Forensics | Ethical Hacking | FCA | SC-200

  • Report contribution
  Algumas das melhores ferramentas e técnicas para engenharia reversa de malware são:Ghidra: Um conjunto de ferramentas de engenharia reversa de software livre e de código aberto desenvolvido pela Agência de Segurança Nacional (NSA). Androguard: Um kit de ferramentas de código aberto para reverter e analisar aplicativos Android.ImHex: Um editor hexadecimal e ferramenta de análise de dados que suporta vários formatos de arquivo, como PE, ELF, Mach-O, etc

  Translated

  Like

  1

• Kalyan Parajuli Security Engineer @ Akamai | CMU INI Alum

  • Report contribution
  Using online Dynamic Analyzer like VirusTotal, any.run, etc. can be a quick way of understanding the behaviors of a malware.Locally, one can run malware in a sandboxed environment like a VM without an internet connection and without network interface connected to the host itself. However, be aware that malwares can use evasive techniques to detect and thwart sandboxed execution. Malwares can look at CPU information, clock information, etc. to detect if they are running in a sandboxed environment and assume a benign execution during that run.

  Like

• Patrick Jung IT-Notfallhandbuch in 2 Tagen! Ihr fehlendes Puzzleteil im Bereich Cyber Security!

  • Report contribution
  Die Netzwerkanalyse zur Identifizierung von Kommunikation zur Command&Control Infrastruktur des Angreifers, kann mit einer sogenannten Beaconing Analyse durchgeführt werden. Hierbei wird nach einer Kommunikation von einem infizierten Client gesucht. Dieser meldet sich regelmäßig bei der C&C Infrastruktur des Angreifers. Dieses Verfahren nennt man Threat Hunting und kann u.a. mit dem Open Source Tool Wazuh durchgeführt werden. Hierzu wird der gesamte Netzwerkdatenverkehr über einen Mirrorport analysiert.

  Translated

  Like

  2

• Elsayed Elrefaei Incident Response Engineer @Kaspersky | GREM

  • Report contribution
  Several methods could be used to classify malware, based on malware characteristics, behavior, and functionality.but I preferer classifying malware in two methods1. code similarities : I usually generate an idb file "ida database" file for any malware I analyze then comparing the similarities between their functions and code. if you found high similarity this may indicates they are from the same code base/family2. based on shared infrastructure, malware usually use their old infrastructure so if you found two families use this domain , IP or specific certificates this may indicates they are under the same APT group or threat actors.3.You can also use fuzzy hash , import hashes, section hashes or VT hashes.but I prefer the first two!

  Like

  3

• Patrick Jung IT-Notfallhandbuch in 2 Tagen! Ihr fehlendes Puzzleteil im Bereich Cyber Security!

  • Report contribution
  Bei einer Malware-Infektion ist es besonders wichtig, auch die Daten aus dem Backup zu bereinigen, da die Infizierung meist schon mehrere Tage vor dem Ausbruch auf den Systemen vorhanden war. Hierzu können sogenannte IoC-Scanner genutzt werden. Diese suchen nach Manipulationen auf den Betriebssystemen. Folgende Tools können unter anderem eingesetzt werden:Loki IoC-ScannerThor IoC-ScannerDes Weiteren kann das Tool Autoruns von Sysinternals zur Überprüfung der Autostart-Programme eingesetzt werden. Hier kann der Hashwert von Dateien automatisch mit Virustotal abgeglichen und eine Infektion identifiziert werden.

  Translated

  Like

  1