Remember how simple things used to be? You’d grab a file’s hash, query a database, see a 'Malicious' hit, and call it a day. Those days are long gone. Nobody relies solely on signature-based protection anymore. But what about those unsigned 'ghost' scripts that live in memory and never even touch the disk? Threat actors have realized it's much easier to slide through the door using your own keys rather than trying to kick it down.
Today, let's grab a coffee in our testCompany lab and look at how we perform an X-ray on a piece of modern malware and decipher those sneaky code snippets. We're going to dive into some assembly, a bit of heuristic analysis, and plenty of 'Wait, they really did that?' moments.
Step One: Looking Through the Glass (Static Analysis)
Looking at malware from the outside before running it is like taking an X-ray of a bomb before trying to defuse it. The first thing we usually check is the file's 'entropy' value. If a file has high entropy (7.5 and above), you can bet that friend is either packed or encrypted. Attackers obfuscate their code specifically to make our analysis harder.
For instance, even a simple Python script to extract readable strings can sometimes whisper a C2 (Command and Control) address to us:
# Defanged String Extractor Mockup
import re
def extract_strings(file_path):
# Zararsızlaştırılmış örnek pattern
pattern = r'[a-zA-Z0-9.:/]{7,}'
with open(file_path, 'rb') as f:
content = f.read().decode('utf-16', errors='ignore')
found = re.findall(pattern, content)
for s in found:
# Örnek C2 yakalama simülasyonu
if "example.com" in s or "127.0.0.1" in s:
print(f"[!] Potansiyel C2 Bulundu: {s}")
# extract_strings('suspicious_payload.bin')
When looking at PE (Portable Executable) headers during static analysis, we focus heavily on the Import Address Table (IAT). If a file is only calling VirtualAlloc, WriteProcessMemory, and CreateRemoteThread, there’s a very high probability that some 'Process Injection' is happening. These functions aren't criminal on their own, but when they show up together, they’re basically screaming, 'I'm about to hijack another process.'
Dynamic Analysis: Controlled Detonation
Static analysis only takes us so far. Some malware is so shy that we have to trick it into thinking it’s not in a sandbox environment. Modern malware uses GetTickCount to check how long the system has been running. If the system has only been up for 5 minutes, it figures, 'This is definitely an analysis lab,' and goes straight to sleep.
When we run the file in our analysis environment (like Remnux or Flare-VM), the first thing we monitor is network traffic. This is where a fake DNS server (FakeDNS) is a lifesaver. When the malware tries to reach out to malicious-c2-server.example.com, we give it the answer 127.0.0.1 and wait for it to hit the listener we’ve set up.
# Defanged NC Listener
nc -lvnp 4444 -s 127.0.0.1