av-gantimurov

Mitmproxy

Steps to configure mitmproxy for ssl interception in malware analysis.

Download and install

wget https://snapshots.mitmproxy.org/5.0.1/mitmproxy-5.0.1-linux.tar.gz --output-document=mitmproxy.tgz
sudo tar -xzvf mitmproxy.tgz -C /usr/local/bin/

Configure

av-gantimurov

List of resources for malware analysts

Books

1. Monappa K.A., "Learning Malware Analysis: Explore the concepts, tools, and techniques to analyze and investigate Windows malware" amazon.
2. Sikorski M., Honig A., "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software" amazon.
3. Ferrie P., "The "Ultimate" Anti-Debugging Reference" [free](https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf

av-gantimurov

#!/bin/sh
find . -type f -iname '*X=' | while read name
do
  newname=$(echo "$name" | sed 's/[[:print:]]*\/=Xutf-8XBX//I; s/X=XXX=Xutf-8XBX//gI; s/X=$//' | base64 -d )
  dir=$(echo $name | sed 's/\/=Xutf-8XBX[A-Za-z0-9X=/+-]\+//I')
  mv --verbose "$name" "${dir}/${newname}"
done