Joe McCray Malware Analysis July 2

Joe McCray July 2

http://pastebin.com/QXURDzma

Coukoo Sandbox
https://infosecspeakeasy.org/t/howto-build-a-cuckoo-sandbox/27

Deep Freeze


http://resources.infosecinstitute.com/portable-malware-lab-for-beginners/

sudo pip install -U olefile

Powershell commands executed in prefetch
https://www.blackhat.com/docs/us-14/materials/us-14-Kazanciyan-Investigating-Powershell-Attacks-WP.pdf

malware@ubuntu:~/Desktop$ mysql -u root -p
Enter password:

show databases;

use malware;

show tables;

describe files;
mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| malware            |
| mysql              |
| performance_schema |
+--------------------+
4 rows in set (0.00 sec)

mysql>
mysql> use malware;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql>
mysql> show tables;
+-------------------+
| Tables_in_malware |
+-------------------+
| files             |
+-------------------+
1 row in set (0.00 sec)

mysql>
mysql> describe files;
+---------+----------+------+-----+---------+----------------+
| Field   | Type     | Null | Key | Default | Extra          |
+---------+----------+------+-----+---------+----------------+
| id      | int(11)  | NO   | PRI | NULL    | auto_increment |
| md5     | text     | YES  |     | NULL    |                |
| sha1    | text     | YES  |     | NULL    |                |
| sha256  | text     | YES  |     | NULL    |                |
| malware | longblob | YES  |     | NULL    |                |
| time    | datetime | YES  |     | NULL    |                |
+---------+----------+------+-----+---------+----------------+
6 rows in set (0.00 sec)