Cuckoo Malware Analysis

Digit Oktavianto, Iqbal Muhardianto

• Publisher: Packt Publishing
• Year: 2013
• eBook ISBN: 9781782169239
• Edition: 1
• Topic: Computer Science
• Subtopic: Cyber Security
• Index: Computer Science

In Detail

Cuckoo Sandbox is a leading open source automated malware analysis system. This means that you can throw any suspicious file at it and, in a matter of seconds, Cuckoo will provide you with some detailed results outlining what said file did when executed inside an isolated environment.

Cuckoo Malware Analysis is a hands-on guide that will provide you with everything you need to know to use Cuckoo Sandbox with added tools like Volatility, Yara, Cuckooforcanari, Cuckoomx, Radare, and Bokken, which will help you to learn malware analysis in an easier and more efficient way.

Cuckoo Malware Analysis will cover basic theories in sandboxing, automating malware analysis, and how to prepare a safe environment lab for malware analysis. You will get acquainted with Cuckoo Sandbox architecture and learn how to install Cuckoo Sandbox, troubleshoot the problems after installation, submit malware samples, and also analyze PDF files, URLs, and binary files. This book also covers memory forensics using the memory dump feature, additional memory forensics using Volatility, viewing result analyses using the Cuckoo analysis package, and analyzing APT attacks using Cuckoo Sandbox, Volatility, and Yara.

Finally, you will also learn how to screen Cuckoo Sandbox against VM detection and how to automate the scanning of e-mail attachments with Cuckoo.

Approach

This book is a step-by-step, practical tutorial for analyzing and detecting malware and performing digital investigations. This book features clear and concise guidance in an easily accessible format.

Who this book is for

Cuckoo Malware Analysis is great for anyone who wants to analyze malware through programming, networking, disassembling, forensics, and virtualization. Whether you are new to malware analysis or have some experience, this book will help you get started with Cuckoo Sandbox so you can start analysing malware effectively and efficiently.

Cuckoo Malware Analysis

---

Table of Contents

Cuckoo Malware Analysis

Credits

About the Authors

Acknowledgement

About the Reviewers

www.PacktPub.com

Support files, eBooks, discount offers and more

Why Subscribe?

Free Access for Packt account holders

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Downloading the example code

Errata

Piracy

Questions

1. Getting Started with Automated Malware Analysis using Cuckoo Sandbox

Malware analysis methodologies

Basic theory in Sandboxing

Malware analysis lab

Cuckoo Sandbox

Installing Cuckoo Sandbox

Hardware requirements

Preparing the host OS

Requirements

Install Python in Ubuntu

Setting up Cuckoo Sandbox in the Host OS

Preparing the Guest OS

Configuring the network

Setting up a shared folder between Host OS and Guest OS

Creating a user

Installing Cuckoo Sandbox

cuckoo.conf

<machinemanager>.conf

processing.conf

reporting.conf

Summary

2. Using Cuckoo Sandbox to Analyze a Sample Malware

Starting Cuckoo

Submitting malware samples to Cuckoo Sandbox

Submitting a malware Word document

Submitting a malware PDF document – aleppo_plan_cercs.pdf

Submitting a malware Excel document – CVE-2011-0609_XLS-SWF-2011-03-08_crsenvironscan.xls

Submitting a malicious URL – http://youtibe.com

Submitting a malicious URL – http://ziti.cndesign.com/biaozi/fdc/page_07.htm

Submitting a binary file – Sality.G.exe

Memory forensic using Cuckoo Sandbox – using memory dump features

Additional memory forensic using Volatility

Using Volatility

Summary

3. Analyzing the Output of Cuckoo Sandbox

The processing module

Analyzing an APT attack using Cuckoo Sandbox, Volatility, and Yara

Summary

4. Reporting with Cuckoo Sandbox

Creating a built-in report in HTML format

Creating a MAEC Report

Exporting data report analysis from Cuckoo to another format

Summary

5. Tips and Tricks for Cuckoo Sandbox

Hardening Cuckoo Sandbox against VM detection

Cuckooforcanari – integrating Cuckoo Sandbox with the Maltego project

Installing Maltego

Automating e-mail attachments with Cuckoo MX

Summary

Index

Cuckoo Malware Analysis

Copyright © 2013 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the authors, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

First published: October 2013

Production Reference: 1091013

Published by Packt Publishing Ltd.

Livery Place

35 Livery Street

Birmingham B3 2PB, UK.

ISBN 978-1-78216-923-9

www.packtpub.com

Cover Image by Prashant Timappa Shetty (<[email protected]>)

Credits

Authors

Digit Oktavianto

Iqbal Muhardianto

Reviewers

Charles Lim

Ashley

Acquisition Editors

Anthony Albuquerque

Amarabha Banerjee

Kartikey Pandey

Commissioning Editor

Shaon Basu

Technical Editor

Akashdeep Kundu

Project Coordinator

Akash Poojary

Proofreader

Kelly Hutchinson

Indexer

Priya Subramani

Graphics

Ronak Dhruv

Production Coordinator

Arvindkumar Gupta

Cover Work

Arvindkumar Gupta

About the Authors

Digit Oktavianto is an IT security professional and system administrator with experience in the Linux server, network security, Security Information and Event Management (SIEM), vulnerability assesment, penetration testing, intrusion analysis, incident response and incident handling, security hardening, PCI-DSS, and system administration.

He has good experience in Managed Security Services (MSS) projects, Security Operation Centre, operating and maintaining SIEM tools, configuring and setup of IDS/IPS, Firewall, Antivirus, Operating Systems, and Applications.

He works as an information security analyst in Noosc Global, a security consultant firm based in Indonesia. Currently, he holds CEH and GIAC Incident Handler certifications. He is very enthusiastic and has a good passion in malware analysis as his main interest for research. This book is the first book that he has written, and he plans to w...

Table of contents

• Cuckoo Malware Analysis