GlacierW / Mba
Licence: other
Malware Behavior Analyzer
Stars: ✭ 125
Programming Languages
c
50402 projects - #5 most used programming language
Projects that are alternatives of or similar to Mba
memscrimper
Code for the DIMVA 2018 paper: "MemScrimper: Time- and Space-Efficient Storage of Malware Sandbox Memory Dumps"
Stars: ✭ 25 (-80%)
Mutual labels: sandbox, malware, forensics
Bold-Falcon
毕方智能云沙箱(Bold-Falcon)是一个开源的自动化恶意软件分析系统;方班网络安全综合实验-设计类；
Stars: ✭ 30 (-76%)
Mutual labels: sandbox, malware
unprotect
Unprotect is a python tool for parsing PE malware and extract evasion techniques.
Stars: ✭ 75 (-40%)
Mutual labels: sandbox, malware
DFIR Resources REvil Kaseya
Resources for DFIR Professionals Responding to the REvil Ransomware Kaseya Supply Chain Attack
Stars: ✭ 172 (+37.6%)
Mutual labels: malware, forensics
malware api class
Malware dataset for security researchers, data scientists. Public malware dataset generated by Cuckoo Sandbox based on Windows OS API calls analysis for cyber security researchers
Stars: ✭ 134 (+7.2%)
Mutual labels: sandbox, malware
fake-sandbox
👁🗨 This script will simulate fake processes of analysis sandbox/VM software that some malware will try to avoid.
Stars: ✭ 110 (-12%)
Mutual labels: sandbox, malware
Automated-Malware-Analysis-List
My personal Automated Malware Analysis Sandboxes and Services
Stars: ✭ 20 (-84%)
Mutual labels: sandbox, malware
Malconfscan
Volatility plugin for extracts configuration data of known malware
Stars: ✭ 327 (+161.6%)
Mutual labels: malware, forensics
Drakvuf Sandbox
DRAKVUF Sandbox - automated hypervisor-level malware analysis system
Stars: ✭ 384 (+207.2%)
Mutual labels: sandbox, malware
Norimaci
Norimaci is a simple and lightweight malware analysis sandbox for macOS
Stars: ✭ 37 (-70.4%)
Mutual labels: sandbox, malware
Tools
Combination of different utilities, have fun!
Stars: ✭ 166 (+32.8%)
Mutual labels: sandbox, qemu
rhino
Agile Sandbox for analyzing Windows, Linux and macOS malware and execution behaviors
Stars: ✭ 49 (-60.8%)
Mutual labels: sandbox, malware
Pafish
Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do
Stars: ✭ 2,026 (+1520.8%)
Mutual labels: sandbox, malware
Artifacts Kit
Pseudo-malicious usermode memory artifact generator kit designed to easily mimic the footprints left by real malware on an infected Windows OS.
Stars: ✭ 99 (-20.8%)
Mutual labels: malware, forensics
Ir Rescue
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
Stars: ✭ 311 (+148.8%)
Mutual labels: malware, forensics
Junest
The lightweight Arch Linux based distro that runs upon any Linux distros without root access
Stars: ✭ 1,134 (+807.2%)
Mutual labels: sandbox, qemu
Awesome Hacking
Awesome hacking is an awesome collection of hacking tools.
Stars: ✭ 1,802 (+1341.6%)
Mutual labels: malware, forensics
Oletools
oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
Stars: ✭ 1,848 (+1378.4%)
Mutual labels: forensics
Hosts Blocklists
Automatically updated, moderated and optimized lists for blocking ads, trackers, malware and other garbage
Stars: ✭ 1,749 (+1299.2%)
Mutual labels: malware
Malware Behavior Analyzer - MBA
- Continuous Integration (Travis-CI)
Introduction
MBA is a QEMU-based, sandbox system dedicated to malware analysis.
Currently, MBA is mainly for the x86_64 architecture and Win10 x64 guest OS.
The following features are supported:
1. De-coupled Information Flow Tracking (DIFT)
It is also known as taint analysis.
Leveraging the DIFT feature, the contamination
conducted by malware to the guest OS can be identified.
We would like to thank Chi-Wei, Wang, who developed the
initial version of DIFT, for sharing his source code. The
original DIFT is mainly for x86 platform. In this project,
the DIFT is upgraded to support modern x86_64 platform.
For the academic paper published by Chi-Wei, Wang, please
cite CW Wang and SP Shieh, "SWIFT: Decoupled System-Wide
Information Flow Tracking and its Optimizations," Journal
of Information Science and Engineering, JISE, 2015.
http://www.iis.sinica.edu.tw/page/jise/2015/201507_15.pdf
2. Disk Forensics (Tsk)
The tsk extension supports the translation between the
disk sector address and the corresponding file in the
Windows guest OS.
3. Memory Forensics (MemFrs)
The memfrs extension performs the virtual machine introspection
on the guest physical/virtual memory. The high-level semantics
of the memory data (e.g. process list) can be interpreted without
the assistence of the guest OS.
4. Windows in-VM Agent (Agent)
The agent extension provides a convenient communication between
the QEMU console and the guest OS. An agent program is needed
to be pre-installed inside the Windows guest to support the
operations such as ...
> execute a command in the guest w/wo return output expected
> import/export a file into/from the guest
5. Out-of-Box Hooking (OBHook)
The obhook extension provides the VM-based hook against the guest OS.
This features allows MBA to intercept the event-of-interest of the guest.
Note that the obhook is purely implemented beneath the guest OS, namely
the hypervisor (QEMU). Thereby, not a code snippets is required to be
inserted to the guest, and thus prevent the interference of malware.
6. Network Traffic Monitor (NetTraMon)
The nettramon extension performs monitoring the network traffic of
the guest OS. This extension provides sniffing, parsing, and filtering
packets, and supports protrocols of TCP, UDP and ICMP. User can also
set files for storing parsed packets according to protocols.
7. Instruction Tracer (Tracer)
The tracer extension supports the runtime instruction trace executed
by a subject sample. This extension provides user-space/kernel-space
tracing instruction tracing functionality
8. System Call Tracer (Systrace)
The systrace extension provides the system call trace of a subject
sample during its runtime phase.
Quick Start
Download MBA source
$ git clone https://github.com/GlacierW/MBA
$ cd MBA/
Configure QEMU to enable all of the MBA features.
To enable a MBA feature individually, please refer to ./configure -h
$ ./configure --target-list=x86_64-softmmu --enable-mba-all
Compile MBA. (May take a while, use -j<CPU_CORE> to speedup)
$ make
Start MBA with the prepared Win10_64bit image in QCOW2 format.
Due to the implementation issue, 2048MB RAM and 16GB disk space for the guest OS are recommended.
$ ./x86_64-softmmu/qemu-system-x86_64 \
-m 2048 \
-hda <YOUR_IMAGE> \
-net nic,model=rtl8139 -net user \
-k en-us -usb \
-monitor stdio \
-vnc :1
Now the VNC server should be able to connect to via the port 5901.
The APIs of each MBA extension can be found in the under the ext directory.
e.g. ext/dift.h for APIs of the DIFT extension
Members
Chi-Wei, Wang [email protected]
Chia-Wei, Wang [email protected]
Chong-Kuan, Chen [email protected]
Hao, Li [email protected]
Jui-Chien, Jao [email protected]
Chuan-Hua, Cheng [email protected]
E-Lin, Ho [email protected]
Distributed System and Network Security Lab, National Chiao-Tung University, Taiwan
Note that the project description data, including the texts, logos, images, and/or trademarks,
for each open source project belongs to its rightful owner.
If you wish to add or remove any projects, please contact us at [email protected].