Back to Details

malware-triage

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Malware Triage

恶意软件分诊

Analyze suspicious samples safely and extract actionable indicators fast.
安全地分析可疑样本，快速提取可执行的指标。

Safety First

安全优先

  • Isolated VM or dedicated sandbox (Cuckoo/ANY.RUN/vendor sandbox), network simulated or sinkholed
  • Samples stored in password-protected archives, hash-named; never opened on analysis-adjacent hosts
  • Work from snapshots; revert after every detonation
  • 使用隔离的 VM 或专用 sandbox（Cuckoo/ANY.RUN/厂商 sandbox），网络环境应采用模拟流量或 sinkhole
  • 样本存储在受密码保护的归档中，并以 hash 命名；绝不要在与分析设备相邻的主机上打开
  • 基于 snapshot 开展工作；每次 detonation 后进行回滚

1. Static Triage

1. 静态分诊

  • Hashes (MD5/SHA256), file type, entropy (
    file
    , 
    pestudio
    -style overview)
  • Strings: URLs, mutexes, registry paths, PDB paths, C2 patterns
  • PE specifics: imports of interest (network, process injection, crypto APIs), digital signature validity, packer detection (entropy + section names)
  • Document metadata (Office macros, embedded objects, remote templates)
  • Hashes（MD5/SHA256）、文件类型、熵值（使用 
    file
    、类似 
    pestudio
    的概览）
  • Strings：URL、mutex、注册表路径、PDB 路径、C2 模式
  • PE 细节：关注的 imports（网络、进程注入、crypto APIs）、数字签名有效性、packer 检测（熵值 + 节名称）
  • 文档元数据（Office 宏、嵌入对象、远程模板）

2. Dynamic Detonation

2. 动态 detonation

  • Execute in sandbox with monitoring: file, registry, network, process activity
  • Capture: dropped files, persistence mechanism, C2 beacons (domains/IPs with ports/protocols)
  • Trigger-dependent malware: require user interaction simulation, geo/fate checks, or debugger awareness — escalate to debugging if silent
  • 在 sandbox 中执行并监控：文件、注册表、网络、进程活动
  • 捕获：释放的文件、持久化机制、C2 beacons（带端口和协议的域名/IP）
  • 依赖触发条件的 malware：需要模拟用户交互、geo/fate checks，或检测 debugger——如果未产生行为，则升级至 debugging

3. Behavior Extraction

3. 行为提取

  • Persistence: Run keys, services, scheduled tasks, WMI subscriptions
  • Injection: process hollowing, APC, SetWindowsHookEx targets
  • Exfiltration: DNS tunneling patterns, HTTP POST shapes, known protocol beacons
  • Defense evasion: AV service stops, AMSI/ETW patching, timestamp manipulation
  • 持久化：Run keys、services、scheduled tasks、WMI subscriptions
  • 注入：process hollowing、APC、SetWindowsHookEx targets
  • 数据外传：DNS tunneling 模式、HTTP POST 形态、已知协议 beacons
  • 防御规避：停止 AV 服务、AMSI/ETW patching、篡改时间戳

4. Classification and Reporting

4. 分类与报告

  • Family attribution via YARA rules against sample set; note confidence
  • Map observed behavior to ATT&CK techniques
  • Produce: IOCs (machine-readable, STIX if required), detection guidance (YARA + behavioral), and a one-page triage summary
  • 通过对样本集运行 YARA rules 进行 family attribution；注明置信度
  • 将观察到的行为映射到 ATT&CK techniques
  • 产出：IOCs（机器可读；如需则采用 STIX）、检测指引（YARA + 行为检测）以及一页式分诊摘要

Escalation Criteria

升级条件

Deep-dive reversing (IDA/Ghidra) only when: C2 protocol reconstruction, config extraction, or unpacking is required for detection/response — not for curiosity.
仅在检测或响应需要重建 C2 协议、提取配置或解包时，才进行深入逆向分析（IDA/Ghidra）——不得仅出于好奇而进行。