Malware homelab & analysis automation

@xanhacks - Hack2G2 workshop
October 2023

https://slides.com/xanhacks/workshop-malware-hack2g2/

https://github.com/xanhacks/workshop-malware-hack2g2

Prerequisites

1

• docker & docker-compose installed
• Bash shell (or equivalent)
• 5GB of disk storage
• Basic knowledge in a programming language

Exercises

2

1. Setup MWDB & Karton using docker-compose
2. Create a Python script to add samples on MWDB from a well-known database (like MalwareBazaar)
3. Reverse the given malware using dnSpy or ILSpy
4. Create a Python script to extract the malware's configuration with dnlib
5. Embed the Python script to a Karton task to auto-extract the malware's configuration on new upload

Do not hesitate to ask for help!

Glossary

3

• Malware: Software specifically designed to disrupt, damage, or gain unauthorized access to computer systems.
• Sample: A file representative of a malware.
• Malware's configuration: Settings of the malware (C2 IP address/port, version, persistence mechanism...).
• Command & Control server (C&C or C2): A server controlled by an attacker which is used to communicate with the malware.
• Malware types: Ransomware, RAT, Wiper, Worm...
• Hash: A unique cryptographic identifier generated from a malware file.

Features

4

1. Database of samples
    
2. Web API & Interface to view/edit information
    
3. Automation of :
   1. Download samples from well-known malware databases to fill our database
   2. Simple tasks on samples (strings, unzip, exif...)
   3. Extraction of malware's configuration
       
4. Easy to deploy and update

Let's begin!

16