Malware Threats & Analysis

Introduction to Malware

Malware making is the part of cybersecurity course. Malware (Malicious Software) is any program designed to harm, exploit, or infiltrate a system without the user's consent. It includes viruses, worms, trojans, ransomware, spyware, and more.

Types of Malware

1. Viruses

- Attaches itself to clean files and spreads when executed.

- Example: ILOVEYOU, Melissa.

2. Worms

- Self-replicating malware that spreads over networks.

- Example: WannaCry, Conficker.

3. Trojans

- Disguised as legitimate software but performs malicious actions.

- Example: Zeus , Emotet.

4. Ransomware

- Encrypts files and demands payment for decryption.

- Example: REvil , LockBit.

5. Spyware

- Secretly monitors user activity (keyloggers, screen capture).

- Example: DarkComet , FinFisher.

6. Rootkits

- Gains privileged access and hides malicious processes.

- Example: Stuxnet , TDL4.

7. Adware

- Displays unwanted ads and collects user data.

- Example: Fireball , Superfish.

8. Botnets

- Infected devices controlled remotely (DDoS, spam).

- Example: Mirai , Zeus.

Malware Analysis Techniques

1. Static Analysis

- Examines malware without executing it.

- Tools:  PEiD ,  Exeinfo PE , Strings , IDA Pro , Ghidra.

- Techniques:

  - File hashing (MD5, SHA-1, SHA-256).

  - Header analysis (PE, ELF, Mach-O).

  - Strings extraction.

  - Disassembly & decompilation.

2. Dynamic Analysis

- Executes malware in a controlled environment.

Tools: Cuckoo Sandbox , Process Monitor , Wireshark , FakeNet.

Techniques:

  - API call monitoring.

  - Registry & file system changes.

  - Network traffic analysis.

  - Behavioral analysis.

3. Hybrid Analysis

- Combines static and dynamic techniques.

Tools: Hybrid Analysis , VirusTotal , Joe Sandbox.

Malware Analysis Lab Setup

1. Isolated Environment

- Use virtual machines (VMWare, VirtualBox).

- Disable shared folders & clipboard.

- Use Windows 10/11 (for malware targeting Windows).

2. Analysis Tools

Static Analysis:

  PE Explorer (PE header analysis).  

  Ghidra (reverse engineering).  

  Detect It Easy (DIE) (packer detection).  

Dynamic Analysis:

  - Process Hacker (monitor processes).  

  - ProcMon (registry/file monitoring).  

  - Wireshark (network traffic).  

  - FakeNet-NG (simulate network).  

Sandboxing:  

  - Cuckoo Sandbox (automated analysis).  

  - Any.Run (interactive sandbox).  

3. Malware Samples

Legitimate Sources:  

  - MalwareBazaar (https://bazaar.abuse.ch)  

  - VirusShare (https://virusshare.com)  

  - TheZoo (GitHub repo).  

⚠️ Warning: Never run malware on a host machine. Always use a disposable VM with no internet access.

Step-by-Step Malware Analysis

1. Initial Assessment

- Check file type (`file`, `Exeinfo PE`).

- Calculate hashes (`md5sum`, `sha256sum`).

- Scan with VirusTotal (https://www.virustotal.com).

2. Static Analysis

- Extract strings (`strings`, `FLOSS`).

- Detect packers/obfuscation (`PEiD`, `Detect It Easy`).

- Disassemble with **Ghidra/IDA Pro.

3. Dynamic Analysis

- Run in Cuckoo Sandbox.

- Monitor processes (`Process Hacker`).

- Capture network traffic (`Wireshark`).

- Check persistence mechanisms (Registry, Startup).

4. Reverse Engineering

- Use Ghidra IDA Pro for decompilation.

- Analyze API calls (`Import Address Table`).

- Debug with x64dbg/OllyDbg.

5. Reporting

- Document findings (IOCs, behavior, C2 servers).

- Extract YARA rules for detection.

Advanced Malware Analysis

1. Analyzing Packed Malware

Unpacking Tools:  

  - UPX (for UPX-packed malware).  

  - x64dbg (manual unpacking).  

2. Analyzing Shellcode

Tools:

  - scdbg (shellcode debugger).  

  - Libemu (shellcode emulator).  

3. Analyzing Document-Based Malware (PDF, Office)

Tools: 

  - oleid (Office file analysis).  

  - PDFiD (PDF analysis).  

4. Analyzing Ransomware

- Check encryption routines.

- Look for ransom note patterns.

- Analyze C2 communication.

Malware Detection & Prevention

1. Signature-Based Detection

- Uses known malware hashes (YARA rules, ClamAV).

2. Behavioral Detection

- Monitors unusual activities (Cylance, CrowdStrike).

3. Heuristic Analysis

- Detects unknown malware based on behavior.

4. Endpoint Protection

- EDR (Endpoint Detection & Response) tools:  

  - CrowdStrike Falcon  

  - Microsoft Defender ATP  

5. Network-Based Protection

- Firewalls , IDS/IPS , SIEM (Splunk, ELK).

Conclusion

- Malware analysis requires both static and dynamic techniques.

- Always analyze in a safe, isolated environment.

- Keep learning reverse engineering and behavioral analysis.

- Stay updated with new malware trends (fileless malware, AI-based attacks).

🔹 Next Steps:  

Module 6: Sniffing & Session Hijacking 

- Practice with CTF challenges (MalwareTech, Flare-On).  

- Join malware research communities (Malwarebytes, BleepingComputer).  

- Contribute to open-source malware analysis tools.