Ransomware Analysis with theZoo Setup
Translated by
ScribdTranslationsRansomware Analysis with theZoo Setup
Translated by
ScribdTranslationsRansomware WEB
Static Analysis
1. Install the software theZoo
theZoo is a database of malware with examples that we can use.
to use
Any use outside this framework may subject the user to prosecution.
judicial
For more info see the linkinGitHub - ytisf/theZoo: A repository of LIVE malwares for your own joy and
pleasure. theZoo is a project created to make the possibility of malware analysis open and available
to the public.
This program is designed for Python 2.7.
If you have a later version, please follow this linkinHow to change from default to alternative
Python version on Debian Linux - Linux Tutorials - Learn Linux Configuration
Installation steps:
• git clone [Link]
• cd theZoo
• pip install --user -r [Link]
2. Recover the ransomware
Once you have installed theZoo, you run:
• python [Link]
We execute the help command to find out which commands we can use.
We execute these commands to download the Ransomware REX
• search rex
• use 160
• info
• get
Now, using the password in the file [Link] run the command
unzip, we decrypt the zip file [Link]
3. Install the anti-malware clamav
To perform the analysis, we need to install the anti-spam clamav
• sudo apt install clamav
Static Analysis
Please answer his questions without executing the ransomware except for question 7.
Question 7 is an introduction to dynamic analysis.
1. Using the file tool, identify the following information:
Execution platform
Nature of the file (binary / library)
Architecture
2. Using the strings tool, retrieve the template of the notification email used to send the
ransom demand to the victim
3. Using the strings tool, determine the list of CMS that can be victims of this
ransomware?
[Link] the help of the clamav tool, scan the ransomware file.
oclamscan -v --debug ransomware_file
[Link] the help of the online antivirusandVirusTotal - Home, scan the ransomware file
6. According to the result from VirusTotal, why do certain antivirus/anti-malware not have
detected this ransomware
7. By executing these commands, determine the first action of the ransomware by disabling
the network card of the VM
chmod u+x ransomware_file
o./ransomware_file -debug -[Link] -[Link]
Dynamic Analysis
Only the kernel can make changes outside the process's memory space.
the process must request the kernel to perform tasks such as creating files or
the writing of an output. This is where system calls come into play.
System calls are the interface used by the application to request services from the kernel.
System calls are generally invoked via glibc wrappers and not directly.
kernel due to portability. Low-level system calls differ between architectures,
That's why glibc handles these differences instead of the developer.
System calls are an interface that malware uses to cause real harm to
system. Analyzing system calls can help us understand how the malware interacts
with the system and how it works behind the scenes.
strace is a powerful tool for tracing the system calls of a file. Each line of the output
strace is a system call, and the first system call will be execve which means to execute the
program. Each system call has a return value that varies between calls.
The return value can be a:
• File descriptor (integer)
• 0 in case of success
• -1 in case of error
• etc.
Example of system calls:
• open/openat - open and possibly create a file.
• read from a file descriptor.
• access - check the user's permissions for a file.
• write - write in a file descriptor.
• mkdir/mkdirat – create directories.
• connect – initiate a connection on a socket.
• socket - creates an endpoint for communication.
• execve - execute the program.
1. Run strace whoami on your Linux virtual machine and examine the output.
2. Identify how the whoami command was able to retrieve the result from the analysis of
the output
Scenario
The REX ransomware has several functionalities:
• Ransomware Attack
• Bitcoin mining
• DDoS attack
We will focus on the 'Ransomware Attack' feature.
The hacker uses bots to scan the network and identify infected Drupal websites.
through the CVE-2014-3704 vulnerability (an SQL injection on Drupal 7).
The bot adds a new admin account, locks all blog posts with ratings,
download and run Rex.
As we saw in question 7 of the static analysis section, Rex sends requests to web.
online geolocation services by @ IP
Rex only begins to be malicious if he receives a response in a proper format.
determined from its web services
If no response in the desired format, then no execution and no ransomware.
To simulate all of this, we need:
A Lab with Web server and MySQL and Drupal
2. Configure Drupal to make it vulnerable to SQL injection vulnerabilities
3. Execute REX with internet access so that it receives a response from these services.
geolocation website
4. Wait for the result of the discovery and network scan to identify the website.
Infected Drupal
Because of all this, it is impossible to achieve all this in the lab.
This is why, here is the log of the beginning of the execution of the Rex ransomware in an environment
similar
[Link]
By analyzing this log file:
Create a list of system calls used by REX and provide the definition of each.
2. Why did REX search for this file?
openat(AT_FDCWD, "/proc/sys/net/core/somaxconn",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
Explain this line:
connect(8, {sa_family=AF_INET, sin_port=htons(5099),
sin_addr=inet_addr("[Link]")}, 16) = -1 EINPROGRESS (Operation now in
progress)