• Search for:
    16Dec, 2023
    How to Analyze Malware’s Network Traffic in A Sandbox

    Malware analysis encompasses a broad range of activities, including examining the malware’s network traffic. To be effective at it, it’s crucial to understand the common challenges and how to overcome them. Here are three prevalent issues you may encounter and the tools you’ll need to address them.

    Decrypting HTTPS traffic

    Hypertext Transfer Protocol Secure (HTTPS), the protocol for secure online communication, has become a tool for malware to conceal their malicious activities. By cloaking data exchange between infected devices and command-and-control (C&C) servers, malware can operate undetected, exfiltrating sensitive data, installing additional payloads, and receiving instructions from the operators.

    Yet, with the right tool, decrypting HTTPS traffic is an easy task. For this purpose, we can use a man-in-the-middle (MITM) proxy. The MITM proxy works as an intermediary between the client and the server, intercepting their communication.

    The MITM proxy aids analysts in real-time monitoring of the malware’s network traffic, providing them with a clear view of its activities. Among other things, analysts can access content of request and response packets, IPs, and URLs to view the details of the malware’s communication and identify stolen data. The tool is particularly useful for extracting SSL keys used by the malware.

    In this example, the initial file, 237.06 KB in size, drops AxilStealer’s executable file, 129.54 KB in size. As a typical stealer, it gains access to passwords stored in web browsers and begins to transfer them to attackers via a Telegram messenger connection.

    The malicious activity is indicated by the rule “STEALER [ANY.RUN] Attempt to exfiltrate via Telegram”. Thanks to the MITM proxy feature, the malware’s traffic is decrypted, revealing more details about the incident.Malware Analysis

    Use a MITM proxy and dozens of other advanced features for in-depth malware analysis in the ANY.RUN sandbox.Request a free trial

    Discovering malware’s family

    Malware family identification is a crucial part of any cyber investigation. Yara and Suricata rules are commonly used tools for this task, but their effectiveness may be limited when dealing with malware samples whose servers are no longer active.

    FakeNET offers a solution to this challenge by creating a fake server connection that responds to malware requests. Tricking the malware to send a request triggers a Suricata or YARA rule, which accurately identifies the malware family.

    Catching geo-targeted and evasive malware

    Many attacks and phishing campaigns focus on specific geographic regions or countries. Subsequently, they incorporate mechanisms like IP geolocation, language detection, or website blocking which may limit analysts’ ability to detect them.

    Alongside geo-targeting, malware operators may leverage techniques to evade analysis in sandbox environments. A common approach is to verify whether the system is using a datacenter IP address. If confirmed, the malicious software stops execution.

    To counter these obstacles, analysts use a residential proxy. This nifty tool works by switching the IP address of the analyst’s device or virtual machine to ordinary users’ residential IPs from different parts of the world.

    This feature empowers professionals to bypass geo-restrictions by mimicking local users and study malicious activities without revealing their sandbox environment.

    Try all of these tools in ANY.RUN

    Setting up and using each of the aforementioned tools individually can take a lot of effort. To access and utilize all of them with ease, use the cloud-based ANY.RUN sandbox.

    The key feature of the service is interactivity, allowing you to safely engage with malware and the infected system just like you would on your own computer.

    You can explore these and numerous other features of ANY.RUN, including private space for your team, Windows 7, 8, 10, 11 VMs, and API integration completely for free.

    Just use a 14-day trial, no strings attached.

    Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.

    Resource : https://thehackernews.com/2023/12/how-to-analyze-malwares-network-traffic.html

    1Feb, 2023
    The Different Types of Cybersecurity

    Cyber security is a wide field covering several disciplines. It can be divided into seven main pillars:

    1. Network Security

    Most attacks occur over the network, and network security solutions are designed to identify and block these attacks. These solutions include data and access controls such as Data Loss Prevention (DLP), IAM (Identity Access Management), NAC (Network Access Control), and NGFW (Next-Generation Firewall) application controls to enforce safe web use policies.

    Advanced and multi-layered network threat prevention technologies include IPS (Intrusion Prevention System), NGAV (Next-Gen Antivirus), Sandboxing, and CDR (Content Disarm and Reconstruction). Also important are network analytics, threat hunting, and automated SOAR (Security Orchestration and Response) technologies.

    2. Cloud Security

    As organizations increasingly adopt cloud computing, securing the cloud becomes a major priority. A cloud security strategy includes cyber security solutions, controls, policies, and services that help to protect an organization’s entire cloud deployment (applications, data, infrastructure, etc.) against attack.

    While many cloud providers offer security solutions, these are often inadequate to the task of achieving enterprise-grade security in the cloud. Supplementary third-party solutions are necessary to protect against data breaches and targeted attacks in cloud environments.

    3. Endpoint Security

    The zero-trust security model prescribes creating micro-segments around data wherever it may be. One way to do that with a mobile workforce is using endpoint security. With endpoint security, companies can secure end-user devices such as desktops and laptops with data and network security controls, advanced threat prevention such as anti-phishing and anti-ransomware, and technologies that provide forensics such as endpoint detection and response (EDR) solutions.

    4. Mobile Security

    Often overlooked, mobile devices such as tablets and smartphones have access to corporate data, exposing businesses to threats from malicious apps, zero-day, phishing, and IM (Instant Messaging) attacks. Mobile security prevents these attacks and secures the operating systems and devices from rooting and jailbreaking. When included with an MDM (Mobile Device Management) solution, this enables enterprises to ensure only compliant mobile devices have access to corporate assets.

    5. IoT Security

    While using Internet of Things (IoT) devices certainly delivers productivity benefits, it also exposes organizations to new cyber threats. Threat actors seek out vulnerable devices inadvertently connected to the Internet for nefarious uses such as a pathway into a corporate network or for another bot in a global bot network.

    IoT security protects these devices with discovery and classification of the connected devices, auto-segmentation to control network activities, and using IPS as a virtual patch to prevent exploits against vulnerable IoT devices. In some cases, the firmware of the device can also be augmented with small agents to prevent exploits and runtime attacks.

    6. Application Security

    Web applications, like anything else directly connected to the Internet, are targets for threat actors. Since 2007, OWASP has tracked the top 10 threats to critical web application security flaws such as injection, broken authentication, misconfiguration, and cross-site scripting to name a few.

    With application security, the OWASP Top 10 attacks can be stopped. Application security also prevents bot attacks and stops any malicious interaction with applications and APIs. With continuous learning, apps will remain protected even as DevOps releases new content.

    7. Zero Trust

    The traditional security model is perimeter-focused, building walls around an organization’s valuable assets like a castle. However, this approach has several issues, such as the potential for insider threats and the rapid dissolution of the network perimeter.

    As corporate assets move off-premises as part of cloud adoption and remote work, a new approach to security is needed. Zero trust takes a more granular approach to security, protecting individual resources through a combination of micro-segmentation, monitoring, and enforcement of role-based access controls.

    Resource : https://www.checkpoint.com/cyber-hub/cyber-security/what-is-cybersecurity/