- Prison Code Breaker Diary -

This step is very simple, we need an anti-virus scanner to identify what the heck is `that thing`.
You might already have installed an anti-virus for your system like Kaspersky Internet Security, Panda Antivirus, ClamAV, AVG, NOD-32....whatever :D
I also use online virus scanners to detect virus.
Here the list of online scanners:

• VirusTotal: http://www.virustotal.com/
• BitDefender Online Scanner: http://www.bitdefender.com/scanner/online/free.html
• Kaspersky Lab: http://www.kaspersky.com/virusscanner/
• TrendMicro - Housecall: http://housecall.trendmicro.com/
• F-Secure Online Virus Scanner: http://www.f-secure.com/en_EMEA/security/security-lab/tools-and-services/online-scanner/
• Panda Active Scan: http://www.pandasecurity.com/homeusers/solutions/activescan/

They're all good scanners; however, VirusTotal is the best one, awesome I think, because it uses most of popular scanners to trace the result and make a list. Additionally, it does query virus file information like import/export, API, function call....pretty convenient!!!

Let's start our journey!

First, we need a malware, I pick a Trojan, Trojan.Win32.VirtualRoot (or CodeRed).
Click here to download Trojan.Win32.VirtualRoot

Then, extract the file, don't double click on it or you're dead. Assuming that you are under virtual machine, ok? Don't do this on your main system.

Access VirusTotal homepage and upload the file (extracted one ...), here the result:

Interesting, huh? As you can see most of scanners identify it as VirtualRoor or CodeRed.
Also, there are something interesting below:


It let us know its MD5 and SHA1 hash, PE information, entry point address, library import/export (kernel32.dll, advapi32.dll) and all API called if it is activated (double-click :D).
Wow, they're valuable information for us in order to monitor and tracking events. Especially, it's very helpful for dissassemly.

Remember, whether you can identify the malware or not, we still need to test it in reality in order to confirm the malware. It's great to write an analysis about the one not being reported yet, isn't it?

Let's stop here!

Have fun!

There are some terminology that you need to know.

1. Malware
2. Virtual Machine
3. Snapshot
4. Disassembler
5. Portable Executable

If there is any more term related, I will post it here.

Have fun!

Before starting to work with malware, you probably need some basic knowledge as requirements. Of course, it's great if you have high experiences in this area.
Here is something I recommend you to know before moving to next step.

1. You must be very familiar with Windows and can use it well. What does that mean? Well, it's simple; you can fix when something goes wrong, you know and can use Windows utilities to fix problems ( msconfig-MS Configuration Utility, regedit-Registry Editor... )...
2. Already have experiences dealing with virus, worm, trojan...
3. Know how to use VMWare or any virtual machine effectively, being able to control Snapshots.
4. Understand assembly code and how it works because we're gonna spend time on disassembling and debugging.
5. Know how to how OllyDbg and IDA.

That's all I guess. It takes your patience and learning ability.

Have fun!

You need to install these tools and utilities to work with:

1. Sysinternals Suite: available from: http://sysinternals.com/
2. OllyDbg: available from: http://ollydbg.de/
3. IDA Pro (freeware): available from: http://www.hex-rays.com/idapro/
4. PEiD: available from: http://www.peid.info/
5. Several packer and unpacker around if require.

You will find more utilities around Internet that can be useful for your work. Just hang around with Google!
Get ready for the next step!

Have fun!

The very first step to think about testing or analyzing application or malware is to prepare yourself an appropriate environment that is under control. It's simple:

• You don't want the application or malware to take the real effects or damage your lovely environment.
• You can control and do whatever you want inside the box.
  
• It's very effective and easy to work.

However, it does have some drawbacks:

• Consume more resources, can cause harm to your computer, such as heating, slow like hell, unexpected NOT RESPONDING of Windows OS overtime ....
  
• Cost may be high depending on your personal references like using 2 or more computers to test, pay high for commercial software (VMWare Workstation...), ..

But that's not the problem if you are well-financial or well-supported or even illegalism, pirated software. Make your own choice!

For this series, I will use VMWare Workstation for this series.
What about VMWare Workstation?

1. It's a virtual machine manager, which provides you the functionality to create and test any operating system inside your main OS and doesn't affect your main one.
2. Get it here: http://www.vmware.com/products/workstation/ . You have 30 days trial for now. It's a good try! My suggestion: buy if you have money because it is so GOOOOD...
   
3. It concerns your hardware requirements. Well, at least 2 GB Ram and share 1/3 or 1/4 to virtual OS is better. It's up to you!

What OS to test, then?
I think it is better to try to common operating system, Windows XP SP2 or SP3.
Here is my virtual OS specifications and settings:


We're gonna take advantages of snapshots while testing the malware.
So for now, setup your environment and get ready for the next shot!

Have fun!

Virus, worms, trojans, mal-application .... or whatever, malware is growing days by days.
I myself have a little interest in this, and am trying my best to practice and analyze them.
Just beginning but hope it will help somebody.

I. Preparation:
1. Creating a controlled environment.
2. Setting up tools and utilities.
3. Basic knowledge and understandings.
4. Terminology.

II. Analysis:
1. Identifying the malware.
2. Monitoring events.
3. Debugging / Disassembling the malware.
4. Verifying and conducting the malware.

II. Conclusion:
1. Summarizing the malware.
2. Special notes or references.

Every section and steps will be written soon and linked to the notes on my blog.
Take your time and gimme any suggestion to improve or correct mistakes.

Have fun!

Download it here: PDF | DOC

Enjoy!