Showing posts tagged #malware analysis

Return Home

Cerber is a popular ransomware that it's still active. In this blogpost, we will analyze and dump Cerber's config using the Cuckoo Sandbox for it.

Prior analysis of Cerber already exist (like this one by Hasherezade).
As state by Hasherezade, Cerber stores it's configuration in an RCDATA resource bundled in the PE header. This RCDATA resource is encrypted and cerber uses a dedicated function to decrypt it.

We will begin analyzing said binary.

CRC32: EF4C42F6
MD5: 9A7F87C91BF7E602055A5503E80E2313
SHA-1: 193F407A2F0C7E1EAA65C54CD9115C418881DE42

If we analyze the function after which call a clear-text configuration is loaded in memory we can see it is using

Read More

In this post I will analyze one on the ELF files captured on my honeypot. First, a dynamic analysis will be performed. Once we aknowledge it's behaviour we will move onto a more in-deep static analysis.

Let's start!


We are presented with a 32-bit ELF un-stripped executable.

$ file 05fd293845e7517bcfc6e8a7fa845ef101bf716c5ec6d40c74c6f7e8aed656bf 
05fd293845e7517bcfc6e8a7fa845ef101bf716c5ec6d40c74c6f7e8aed656bf: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped, too many notes (256)

Analyzing the network traffic

Executing the malware sample with Wireshark listening on our routing machine shows that our sample is trying to contact server 218.2.0.

Read More

Logging Cowrie logs to the ELK stack

dashboard

This entry will cover the basics of setting up the Cowrie SSH honeypot and Filebeat to export Cowrie's logs to Elasticsearch, so we can use Kibana to visualize them in charts.

Goal

We will have 2 servers with private networking between them. One will host the ELK stack and the other one Cowrie + Filebeat.

The ELK server will receive and store the logs in ElasticSearch, so we can easily search and visualize them using Kibana, the ElasticSearch front-end.

The honeypot will just give it service and ship logs to the ELK server.

Prerequisites

  • A working ELK installation. Which you can

Read More