Dark Angel Index du Forum
Dark Angel
Hacking and Reverse
 
Dark Angel Index du ForumFAQRechercherS’enregistrerConnexion

:: Analyseur de Malware ::

 
Poster un nouveau sujet   Répondre au sujet    Dark Angel Index du Forum -> Hacking -> Vx
Sujet précédent :: Sujet suivant  
Auteur Message
Nostradamus
Membre
Membre

Hors ligne

Inscrit le: 26 Nov 2009
Messages: 33

MessagePosté le: Ven 11 Déc - 16:28 (2009)    Sujet du message: Analyseur de Malware Répondre en citant

#!/usr/bin/python
################################################################
# .___ __ _______ .___ #
# __| _/____ _______| | __ ____ \ _ \ __| _/____ #
# / __ |\__ \\_ __ \ |/ // ___\/ /_\ \ / __ |/ __ \ #
# / /_/ | / __ \| | \/ <\ \___\ \_/ \/ /_/ \ ___/ #
# \____ |(______/__| |__|_ \\_____>\_____ /\_____|\____\ #
# \/ \/ \/ #
# ___________ ______ _ __ #
# _/ ___\_ __ \_/ __ \ \/ \/ / #
# \ \___| | \/\ ___/\ / #
# \___ >__| \___ >\/\_/ #
# est.2007 \/ \/ forum.darkc0de.com #
################################################################
# Greetz to all Darkc0de ,AI,ICW Memebers
#Shoutz to r45c4l,j4ckh4x0r,silic0n,smith,baltazar,d3hydr8,lowlz,Eberly,Sumit,zerocode,dalsim,7
#The application can be used to perform intial malware analysis phase.
#Download the PE Module . Else Application won't work:http://code.google.com/p/pefile/
#Some of the deeper Analysis can be perform on Linux OS, so i would prefer to perform analysis on linux OS.
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.

#This program is distributed in the hope that it will be useful,
#but WITHOUT ANY WARRANTY; without even the implied warranty of
#MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
#GNU General Public License for more details.

#You should have received a copy of the GNU General Public License
#along with this program. If not, see <http://www.gnu.org/licenses/>.

import os,sys,re,string

def checkconfig():
try:
import pefile,peutils

except(ImportError):
print "\n[!] PE Module Missing."
print "\n[!] Download PE Module from [ http://code.google.com/p/pefile/ ]"
sys.exit(0)


# Say Hello

if sys.platform == 'linux-i386' or sys.platform == 'linux2' or sys.platform == 'darwin':
SysCls = 'clear'
elif sys.platform == 'win32' or sys.platform == 'dos' or sys.platform[0:5] == 'ms-dos':
SysCls = 'cls'
else:
SysCls = 'unknown'

os.system(SysCls)

print "\n|---------------------------------------------------------------|"
print "| beenudel1986[@]gmail[dot]com |"
print "| Malware Analyzer(Static) 1.3 |"
print "| 06/2009 analyse_malware.py |"
print "| Do Visit www.BeenuArora.com |"
print "|---------------------------------------------------------------|\n"


INTERESTING_CALLS = ["CreateMutex", "CopyFile", "CreateFile.*WRITE", "NtasdfCreateFile", "call shell32", "advapi32.RegOpenKey",
"KERNEL32.CreateProcess", "shdocvw", "gethostbyname", "ws2_32.bind", "ws2_32.listen", "ws2_32.htons",
"advapi32.RegCreate", "advapi32.RegSet", "http://","Socket",
"^([01]?\d\d?|2[0-4]\d|25[0-5])\.([01]?\d\d?|2[0-4]\d|25[0-5])\.([01]?\d\d?|2[0-4]\d|25[0-5])\.([01]?\d\d?|2[0-4]\d|25[0-5])",
"OutputDebugString","GetEnvironmentStrings","LoadLibraryA","WSASocketA", "GetProcAddress",
"FindWindow","CreateProcess","DuplicateTokenEx","ImpersonateNamedPipeClient","RevertToSelf","signal",
"IsDebuggerPresent"
]
INTERESTING_CALLS_DLLS=["KERNEL32.DLL","advapi32.dll","comctl32.dll","gdi32.dll","ole32.dll","oleaut32.dll","user32.dll","wsock32.dll","ntdll.dll"]
INTERESTING_SYS_CALLS=["ping.exe","telnet.exe"]
REGISTRY_CALLS =["HKEY_CURRENT_USER","HKEY_CLASSES_ROOT","HKEY_LOCAL_MACHINE","autorum.inf"]
ONLINE_WORK =["IRC","Joined channel","Port","BOT","Login","flood","ddos","NICK","ECHO","PRIVMSG","ADMIN","AWAY","CONNECT","KICK","LIST","MODE","MOTD","PING","PONG","QUIT","SERVLIST","SERVICE","NAMES","JOIN","INVITE","INFO","TRACE","USERHOST","WHO","WHOIS","VERSION"]

if (len (sys.argv) <2):
print "\n Usage: ./analyse_malware.py <MALWARE FILENAME>\n"
print "\t\t Example: ./analyse_malware.py malware.exe\n"
print "\tFor Help: ./analyse_malware.py --help\n"
sys.exit(0)

for arg in sys.argv:
if arg=='--help':
print " To Perform Complete Analysis: Usage: ./analyse_malware.py [Malware FIle]\n "
print " To Generate ASCII Dump: Usage: ./analyse_malware.py [Malware File] --Ascii\n"
print " To View Dlls Loaded: Usage: ./analyse_malware.py [Malware File] --Dll\n"
print " To View the PE Areas: Usage: ./analyse_mwlare.py [Malware File] --Header\n"
print "\n\t Example: ./analyse_malware.py malware.exe --Dll\n"
sys.exit(0)



malware=sys.argv[1]

try:
hosts= open(malware,'r').readlines()
except (IOError):
print " \n\n[!]Malware Missing .Exiting.\n"
sys.exit(0)

def start_analysis_system_calls():
performed=[]
for line in hosts:
for calls in INTERESTING_CALLS:
if re.search(calls, line):
if not calls in performed:
print "[+] Found an Interesting call to: ",calls
performed.append(calls)


def start_analysis_registry():
for line in hosts:
for calls in REGISTRY_CALLS:
if re.search(calls, line):
print "[+] Malware is Adding a Key at Hive: ",calls
print line
def calls_to_dlls():
if sys.platform == 'linux-i386' or sys.platform == 'linux2' or sys.platform == 'darwin':
str="objdump -x "+malware+" | grep DLL >result"
#print str
print "\n Since Host OS is Linux. Peforming Deeper Analysis\n"
details=os.system(str)
dllresult=open('result','r').readlines()
print "\n [+] Dlls Loaded are:\n"
for line in dllresult:
print line
os.system("rm result")
else:
for line in hosts:
for calls in INTERESTING_CALLS_DLLS:
if re.search(calls, line):
print "\n[+] Loaded Dll: ",calls
def find_import_table():
str="objdump -x "+malware+" | grep \"import table\" >impresult"
os.system(str)


importresult=open('impresult','r').readlines()
for line in importresult:
print line
os.system("rm impresult")

def start_address():
str="objdump -x "+malware+" | grep \"start address\" >startresult"
os.system(str)
stresult=open('startresult','r').readlines()
for line in stresult:
print line
os.system("rm startresult")

def header_info():
str="objdump -h "+malware+" >header"
os.system(str)
headresult=open('header','r').readlines()
for line in headresult:
print line
os.system("rm header")

def generate_dump():
str="objdump -s "+malware+" >ascii_dump"
os.system(str)
headresult=open('ascii_dump','r').readlines()
for line in headresult:
print line

def calls_to_syscommand():
for line in hosts:
for calls in INTERESTING_SYS_CALLS:
if re.search(calls, line):
print "\n[+] Call Made: ",calls
print "\n\n[!] It Can be Part of DDOS Network.\n"

def start_analysis_online():
performed=[]
for line in hosts:
for calls in ONLINE_WORK:
if re.search(calls, line):
if not calls in performed:
print "[+] Malware Seems to be IRC BOT: Verified By String :",calls
performed.append(calls)
def getSignatureForPe(pe):
try:
signatures = peutils.SignatureDatabase(PE_SIGNATURE_PATH)
return signatures.match_all(pe)
except:
print ""

def get_pe_signature():
try:
pe = pefile.PE(malware)
signatureInfo = getSignatureForPe(pe)
peInfo = pe.dump_info()
print peInfo
except:
print "\n\n[!] Download PE Package from google code.\n"
print "\n[!]Exiting.\n"


def generate_dump():
filename="ascii_dump_"+malware+".txt"
str="objdump -s "+malware+" > "+filename
os.system(str)
headresult=open(filename,'r').readlines()
for line in headresult:
print line
print "\n Check "+filename+" for the ASCII dump output"
raw_input("\n Press <Enter> to Exit.\n")
sys.exit(0)



def checkPE():
print "\n Analysing if PE file...\n"
check = file(malware, "rb")
buff = check.read(2)
check.close()
if buff == "MZ":
print "\n[+] Valid PE file."
print "\n[+] Malware File Size :" , (os.path.getsize(malware))/1000 ,"KB"
else:
print "[!] Not a Valid PE File. Exiting.!\n"
sys.exit(0)

def checkargs():
for arg in sys.argv:
if arg.lower()=="--ascii":
if sys.platform == 'linux-i386' or sys.platform == 'linux2' or sys.platform == 'darwin':
checkPE()
generate_dump()
sys.exit(0)
else:
print "\n This Analysis is Applicable on Linux OS only"
sys.exit(0)

if arg.lower()=="--dll":
if sys.platform == 'linux-i386' or sys.platform == 'linux2' or sys.platform == 'darwin':
checkPE()
calls_to_dlls()
sys.exit(0)
else :
print "\n This Analysis is Applicable on Linux OS only"
sys.exit(0)

if arg.lower()=="--header":
if sys.platform == 'linux-i386' or sys.platform == 'linux2' or sys.platform == 'darwin':
checkPE()
header_info()
sys.exit(0)
else :
print "\n This Analysis is Applicable on Linux OS only"
sys.exit(0)


def apps_start():
checkconfig()
checkPE()
checkargs()
print "\n[!] Displaying Interesting System Calls Made.\n"
start_analysis_system_calls()
if sys.platform == 'linux-i386' or sys.platform == 'linux2' or sys.platform == 'darwin':
print "\n[+] Displaying Address of Import Table\n"
find_import_table()
print "\n[+] Displaying the Start Address\n"
start_address()
print "\n[+] Displaying the Header Sections and File Format"
header_info()
print "\n[!] Displaying Registry Hives Edited.\n"
start_analysis_registry()
print "\n\n[!] Displaying A Little Online Behaviour.\n"
start_analysis_online()
print "\n\n[!] Displaying the Loaded DLLs.\n"
calls_to_dlls()
print "\n\n[!] Commands Inside the Malware.\n"
calls_to_syscommand()
print "\n\n[!] Displaying the Headers of the Malware.\n"
get_pe_signature()

apps_start()


Revenir en haut
Publicité






MessagePosté le: Ven 11 Déc - 16:28 (2009)    Sujet du message: Publicité

PublicitéSupprimer les publicités ?
Revenir en haut
Montrer les messages depuis:   
Poster un nouveau sujet   Répondre au sujet    Dark Angel Index du Forum -> Hacking -> Vx Toutes les heures sont au format GMT + 1 Heure
Page 1 sur 1

 
Sauter vers:  

Portail | Index | Panneau d’administration | créer forum | Forum gratuit d’entraide | Annuaire des forums gratuits | Signaler une violation | Conditions générales d'utilisation
HalloweenOclock © theme by larme d'ange 2006
Powered by phpBB © 2001, 2005 phpBB Group
Traduction par : phpBB-fr.com