Introduces several virus sample analysis formats and presents our own analysis strategies.

Number of virus sample formats: 1 Kaspersky virus analysis

Detailed to the bone. Intentional graph analysis and template relationship. Writer characteristics, etc. IP traceability is commonplace.

2 Gold Hill Fire Eye type

1. Basic information
2. Flame Reviews
3. Dangerous behavior
4. Other Acts
   
   1. Behavior description
   2. Additional Information
5. Registry Monitoring
6. Network Monitoring

It is important to note that Burner uses up to two hashes to determine a sample. Of course you can use one of them.

3Comodo (green soybean) online analytical type

This is a typical result of scanning with soy beans:

Comodo the sample query operation by SHA256:

4.SysTracer Monitoring Report

Here should be a brief introduction to Systracer, which is a behavioral tracking monitoring program. " "The use of a large number of hooks: Shadow SSDT 667 functions are all hooked, SSDT also failed to" survive ", a total of 284 functions except Ntacceptconnectport,ntaddatom,ntdeviceiocontrolfile , all 280 functions outside the ntyieldexecution are hooked. This ensures that the behavior of the generic malicious program is fully documented.
It is important to note that the previous tracking experience found that the creation of mutexes was not systracer recorded. In addition, due to the mechanism of the kernel program for the behavior of the systracer is not the case.

The following is its monitoring report:

As you can see, it describes the behavior of the different processes created by the sample. Facilitates a clear understanding of the behavior of samples by anti-virus engineers. What if we add a tree diagram?

How are we going to do that?

First we should classify the malicious program.

1 hazards

is the remote control active? Or is it just a lost time bomb?
A runaway program backdoor means that any malicious person could use this to control malicious programs that continue to pose a threat to user information security.

2 Technical strength-procedures for self-protection and complexity

Does the other party use a proven approach to avoid killing soft? or the latest exploits?
Strong self-protection is often done to cover up more information. It is also thought that the producer's team is unusually large. This is often accompanied by a large number of machines being infected and possibly forming botnets .
Such a program is worth using Kaspersky Analytics to explore. To enable us to provide more information on sample research to other anti-virus engineers.

Copyright NOTICE: This article for Bo Master original article, without Bo Master permission not reproduced.

Introduces several virus sample analysis formats and presents our own analysis strategies.