Peoples,

I've recently put a Nepenthes server into production. There were several reasons for this, from trying to get a better view of what's out there, training resources and just 'for fun' (yes I'm a bit strange).

Unfortunately, the server is being too successful and is providing more samples than I can analyse in the timeframe available. Can anyone provide tips so that I can quickly identify and focus on the 'interesting' samples rather than spend time and resources investigating 'garden variety' malware?

Any advice appreciated, thanks in advance.
RR

Initially you have to work really hard and analyse as much malware as you can. After some time you'll get a feel about what is interesting and what is not.

Nepenthes is a low interaction honeypot. As such it can only simulate known vulnerable services. As it can only simulate a known vuln it will not catch an 0day exploit. What it will capture is the initial network traffic of the exploit before it 'changes direction' and diverges from the vulnerability being emulated. This traffic is captured via the portwatch module. Ideally, you would want a high interaction (actual system) honeypot to see exactly what this malware would attempt to exploit. Look at the genIII honeypot/net from the honeynet project if you want a high interaction honeypot.

Look into the submission module that allows you to submit samples to Norman and CWsandbox automatically. This will speed up initial analysis.

Also, be aware that most malware (even 'unknown' variants) will likely use known exploit(s) to spread. This does not mean that the malware itself is not new. I have a sample currently that after two weeks is still only detected by 5 out of 32 AVs. This sample spread through an sequence of iframes and javascript/VB on about 4 different sites. Multiple known exploits were offered up based on the browser type, OS, 3rd party app, etc... to exploit the system in order to finally download and run it.

A lot of malware (the latest stormworm iteration for example) will use two or more stages to download the malware onto the system. The initial exe can end up being the only way to get the final payload.

/dean

A common theme in malware today is dynamic code generation and custom packing. All this is automated now. One interesting example I found was a site that dynamically generated malicious javascript and shellcode when it was accessed. Each visit would produce code with unique variables and even the shellcode was changed each time.

This might be why your examples are not showing up on offensivecomputing. One char different will change the hash.

Run your samples through:

Virustotal
Norman Sandbox
CWsandbox

if they have been submitted before the sites will let you know. If not an analysis will be done automatically.

A high intereaction honeypot will execute the malware and if that malware is a dropper for additional malware then that will also be downloaded and installed.

I would suggest reading up on the various types of honeypots available, including client honeypots. Also, realize that if you run a high interaction honeypot that the potential for it to be used to attack another host is there.

http://www.securityfocus.com/infocus/1897/1 <-- this is not a bad intro to the different options available to you.

If you want to make this process more exciting, treat it as hunting. Have you watched AVP (Aliens vs Predators). After you got the sample from Nepenthes, you can run it inside a "controlled" and "restricted" network. Then use some sniffing/ids/ips/av tools to observe the life-cycle of the malware, from infection to detection. With this you can build a strong skills about malwares analysis and how to build defenses. For more infomation about manual malware analysis, give it a try here:

http://extremesecurity.blogspot.com/2008/02/analyze-malware-infections-on-your-own.html

http://extremesecurity.blogspot.com/2008/02/analyze-malware-infections-on-your-own_10.html

http://extremesecurity.blogspot.com/2008/02/malwares-containment-basics.html

http://extremesecurity.blogspot.com/2008/02/malwares-containment-level-ii.html

http://extremesecurity.blogspot.com/2008/03/malwares-containment-quarantine.html


http://extremesecurity.blogspot.com

Don will be leaving us soon to become the next Secretary of State