AgentSkillsCN

malware-patterns

常见恶意软件行为和分析模式

SKILL.md
--- frontmatter
name: malware-patterns
description: Common malware behaviors and analysis patterns

Malware Analysis Patterns

Common Behaviors

Persistence Mechanisms

  • •Registry Run keys (Windows)
  • •Scheduled tasks / cron jobs
  • •Service installation
  • •DLL hijacking
  • •Boot sector modification

Anti-Analysis Techniques

  • •Debugger detection (ptrace, IsDebuggerPresent)
  • •VM detection (CPUID, registry, timing)
  • •Sandbox detection (user activity, artifacts)
  • •Code obfuscation
  • •Packed/encrypted payloads

C2 Communication

  • •HTTP/HTTPS beaconing
  • •DNS tunneling
  • •Custom protocols
  • •Domain generation algorithms (DGA)
  • •Dead drops (pastebin, social media)

Analysis Techniques

String Decryption

XOR decryption:

python
def xor_decrypt(data, key):
    return bytes([b ^ key[i % len(key)] for i, b in enumerate(data)])

# Single byte key
decrypted = xor_decrypt(encrypted, b'\x42')

# Multi-byte key
decrypted = xor_decrypt(encrypted, b'secret')

RC4 decryption:

python
def rc4_init(key):
    S = list(range(256))
    j = 0
    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) % 256
        S[i], S[j] = S[j], S[i]
    return S

def rc4_crypt(S, data):
    S = S.copy()
    i = j = 0
    result = []
    for byte in data:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        result.append(byte ^ S[(S[i] + S[j]) % 256])
    return bytes(result)

Payload Extraction

LD_PRELOAD hooking:

c
// hook_memfd.c
#define _GNU_SOURCE
#include <dlfcn.h>
#include <stdio.h>

int memfd_create(const char *name, unsigned int flags) {
    int (*real_memfd)(const char*, unsigned int) = dlsym(RTLD_NEXT, "memfd_create");
    int fd = real_memfd(name, flags);
    fprintf(stderr, "[HOOK] memfd_create('%s') = %d\n", name, fd);
    return fd;
}

ssize_t write(int fd, const void *buf, size_t count) {
    ssize_t (*real_write)(int, const void*, size_t) = dlsym(RTLD_NEXT, "write");
    // Dump to file for analysis
    FILE *f = fopen("/tmp/captured_payload", "ab");
    fwrite(buf, 1, count, f);
    fclose(f);
    return real_write(fd, buf, count);
}

Compile and use:

bash
gcc -shared -fPIC -o hook.so hook.c -ldl
LD_PRELOAD=./hook.so ./malware

Memory Forensics

Volatility 3 basics:

bash
# List processes
vol -f memory.dmp windows.pslist

# Dump process memory
vol -f memory.dmp windows.memmap --pid 1234 --dump

# Find injected code
vol -f memory.dmp windows.malfind

Indicators of Compromise (IOCs)

Network IOCs

  • •IP addresses
  • •Domain names
  • •URLs
  • •User-Agent strings
  • •JA3/JA3S fingerprints

Host IOCs

  • •File hashes (MD5, SHA256)
  • •File paths
  • •Registry keys
  • •Mutex names
  • •Service names

Documentation Template

markdown
## IOCs

### Network
| Type | Value | Context |
|------|-------|---------|
| IP | 192.168.1.100 | C2 server |
| Domain | evil.com | DGA generated |

### Host
| Type | Value | Context |
|------|-------|---------|
| Hash | abc123... | Main payload |
| Path | /tmp/.hidden | Dropped file |
| Mutex | Global\XYZ | Infection marker |

Anti-Debug Bypass

ptrace Detection

c
// Malware checks:
if (ptrace(PTRACE_TRACEME, 0, 0, 0) == -1) {
    exit(1);  // Being debugged
}

// GDB bypass:
(gdb) catch syscall ptrace
(gdb) commands
> set $rax = 0
> continue
> end

Timing Checks

c
// Malware checks:
t1 = rdtsc();
// ... code ...
t2 = rdtsc();
if (t2 - t1 > threshold) exit(1);  // Debugger detected

// Bypass: Patch comparison or NOP the check