CAPEv2

CAPE: 악성코드 설정 및 페이로드 추출 - 문서 CAPE는 악성코드 샌드박스입니다. 샌드박스는 악성 파일을 격리된 환경에서 실행하여 동적 행동을 계측하고 포렌식 아티팩트를 수집하는 데 사용됩니다. CAPE는 Cuckoo v1에서 파생되었으며 Windows 플랫폼에서 다음과 같은 핵심 기능을 제공합니다: API 후킹 기반 행동 계측 실행 중 생성, 수정, 삭제된 파일 캡처 PCAP 형식의 네트워크 트래픽 캡처 행동 및 네트워크 시그니처 기반 악성코드 분류 악성코드 실행 중 데스크톱 스크린샷 캡처 대상 시스템의 전체 메모리 덤...

pharos

Pharos Static Binary Analysis Framework The Pharos static binary analysis framework is a project of the Software Engineering Institute at Carnegie Mellon University. The framework is designed to facilitate the automated analysis of binary programs. It uses the ROSE compiler infrastructure develop...

signature-base

Signature-Base Signature-Base는 당사 스캐너 LOKI 및 THOR Lite를 위한 YARA 시그니처 및 IOC 데이터베이스입니다. Signature-Base의 초점 1. 최소한의 오탐지를 가진 고품질 YARA 규칙 및 IOC 2. 명확한 구조 3. 일관된 규칙 형식 디렉터리 구조 iocs - 간단한 IOC 파일 CSV yara - YARA 규칙 threatintel - 위협 인텔 API 수신기 MISP, OTX misc - 기타 입력 파일 IOC 또는 시그니처가 아님 YARA 규칙의 외부 변수 LOKI ...

PortexAnalyzerGUI

PortexAnalyzerGUI PortEx Portable Executable 및 Malware Analysis 라이브러리의 그래픽 인터페이스 다운로드 릴리스 페이지 기능 헤더 정보: MSDOS Header, Rich Header, COFF File Header, Optional Header, Section Table, .NET Metadata PE 구조: Import Section, Resource Section, Export Section, Debug Section 파일 형식 이상 및 특정 조합에 대한 리버싱 힌트 스캔 ...

yara-rules

yara-rules 最近のマルウェア調査から収集した YARA シグネチャのコレクション ルールセット Dacls Trojan ルール: DaclsLinux.yara ルール: DaclsWindows.yara 参照: https://blog.netlab.360.com/dacls-the-dual-platform-rat/ APT32 KerrDown ルール: APT32KerrDown.yara 参照: https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/...

CAPE - Malware Configuration And Payload Extraction

CAPE is a malware sandbox. It is derived from Cuckoo and is designed to automate the process of malware analysis with the goal of extracting payloads and configuration from malware. This allows CAPE to detect malware based on payload signatures, as well as automating many of the goals of malware...

ThreatIngestor - Extract And Aggregate Threat Intelligence

An extendable tool to extract and aggregate IOCs from threat feeds. Integrates out-of-the-box with ThreatKB and MISP, and can fit seamlessly into any existing worflow with SQS, Beanstalk, and custom plugins. Overview ThreatIngestor can be configured to watch Twitter, RSS feeds, or other sources,...

Pharos: A Static Binary Analysis Framework

PenTestIT RSS Feed All of us know what static binary analysis means. It means that the analysis of the binary is performed without actually executing it. Almost two years ago, an open source framework - Pharos, was created by the Carnegie Mellon SEI, CERT Division in collaboration with the Lawren...

Artificial Inteligent Packet Inspection Engine: AIEngine

AIEngine is a next generation interactive/programmable Python/Ruby/Java packet inspection engine with capabilities of learning without any human intervention, NIDS Network Intrusion Detection System functionality, DNS domain classification, network collector, network forensics and many others...

QuickSand.io - Tool For Scanning Streams Within Office Documents Plus Xor DB Attack

QuickSand is a compact C framework to analyze suspected malware documents to 1 identify exploits in streams of different encodings, 2 locate and extract embedded executables. By having the ability to locate embedded obfuscated executables, QuickSand could detect documents that contain zero-day or...

Noriben - Portable, Simple, Malware Analysis Sandbox

Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you to run your malware, hit a keypress, and get a simple text report of the sample's activities. Noriben...

Noriben - Your Personal, Portable Malware Sandbox

Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you to run your malware, hit a keypress, and get a simple text report of the sample's activities. Noriben...

[Cuckoo Sandbox v0.6] Software for Automating Analysis of Suspicious Files

Cuckoo Sandbox is an Open Source software for automating analysis of suspicious files. To do so it makes use of custom components that monitor the behavior of the malicious processes while running in an isolated environment. Cuckoo generates a handful of different raw data which include: Native...