av-gantimurov

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
Script for decoding string in AgentTesla source code for samples from Oct2020
Searches for specific class name. Class name may be defined by command arg.


Author: Gantimurov Alexander
Date: 2020-12-04 10:13
"""

av-gantimurov

'\x00'
'\x00\x00\x00'
'\x02'
'\x03'
'\tINTEGER '
'\tOBJECTIDENTIFIER '
'\tOCTETSTRING '
'\n'
'\r'
'\r\n'

av-gantimurov

#!/usr/bin/env python3
import itertools

def xor(data, key):
    return bytearray(a ^ b for a, b in zip(data, itertools.cycle(key)))

av-gantimurov

Mitmproxy

Steps to configure mitmproxy for ssl interception in malware analysis.

Download and install

wget https://snapshots.mitmproxy.org/5.0.1/mitmproxy-5.0.1-linux.tar.gz --output-document=mitmproxy.tgz
sudo tar -xzvf mitmproxy.tgz -C /usr/local/bin/

Configure

av-gantimurov

List of resources for malware analysts

Books

1. Monappa K.A., "Learning Malware Analysis: Explore the concepts, tools, and techniques to analyze and investigate Windows malware" amazon.
2. Sikorski M., Honig A., "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software" amazon.
3. Ferrie P., "The "Ultimate" Anti-Debugging Reference" [free](https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf

av-gantimurov

#!/bin/sh
find . -type f -iname '*X=' | while read name
do
  newname=$(echo "$name" | sed 's/[[:print:]]*\/=Xutf-8XBX//I; s/X=XXX=Xutf-8XBX//gI; s/X=$//' | base64 -d )
  dir=$(echo $name | sed 's/\/=Xutf-8XBX[A-Za-z0-9X=/+-]\+//I')
  mv --verbose "$name" "${dir}/${newname}"
done