ProHoster > Blog > Tsamaiso > 1. Analysis ea malware sebelisa Check Point forensics. SandBlast Network

1. Analysis ea malware sebelisa Check Point forensics. SandBlast Network

1. Analysis ea malware sebelisa Check Point forensics. SandBlast Network

Rea u amohela letotong le lecha la lingoloa, lekhetlong lena mabapi le taba ea lipatlisiso tsa liketsahalo, e leng tlhahlobo ea malware e sebelisang li-forensics tsa Check Point. Re phatlalalitse pejana lithuto tse ngata tsa video mabapi le ho sebetsa ho Smart Event, empa lekhetlong lena re tla sheba litlaleho tsa forensics mabapi le liketsahalo tse ikhethileng lihlahisoa tse fapaneng tsa Check Point:

Ke hobane'ng ha li-forensics tsa thibelo ea liketsahalo li le bohlokoa? Ho ka bonahala eka u tšoasitse vaerase, e se e lokile, hobaneng u sebetsana le eona? Joalokaha tloaelo e bontša, ho eletsoa hore u se ke ua thibela tlhaselo feela, empa hape u utloisise hantle hore na e sebetsa joang: sebaka sa ho kena e ne e le sefe, ho ne ho sebelisoa kotsi efe, ke mekhoa efe e amehang, hore na registry le tsamaiso ea lifaele li ameha, ke lelapa lefe. ea likokoana-hloko, ke tšenyo efe e ka bang teng, joalo-joalo. Lintlha tsena le tse ling tse molemo li ka fumanoa ho tsoa litlalehong tse felletseng tsa lipatlisiso tsa Check Point (lingoloa le litšoantšo). Ho thata haholo ho fumana tlaleho e joalo ka letsoho. Lintlha tsena li ka thusa ho nka khato e nepahetseng le ho thibela litlhaselo tse tšoanang ho atleha nakong e tlang. Kajeno re tla sheba tlaleho ea lipatlisiso tsa marang-rang ea Check Point SandBlast Network.

SandBlast Network

Tšebeliso ea li-sandboxes ho matlafatsa tšireletso ea sebaka sa marang-rang e 'nile ea e-ba ntho e tloaelehileng' me e tlamehile e le karolo ea IPS. Ho Check Point, lehare la Threat Emulation, e leng karolo ea mahlale a SandBlast (ho boetse ho na le Threat Extraction), le ikarabella bakeng sa ts'ebetso ea sandbox. Re se re phatlalalitse pele thupelo e nyane ho Check Point SandBlast hape bakeng sa phetolelo ea Gaia 77.30 (Ke khothaletsa haholo ho e shebella haeba u sa utloisise seo re se buang hona joale). Ho ea ka pono ea meralo, ha ho letho le fetohileng ho tloha ka nako eo. Haeba u na le Check Point Gateway moeling oa marang-rang a hau, joale u ka sebelisa likhetho tse peli bakeng sa ho kopanya le sandbox:

  1. Sesebelisoa sa Sebaka sa SandBlast - sesebelisoa se eketsehileng sa SandBlast se kentsoe marang-rang a hau, moo lifaele li romelloang ho hlahlojoa.
  2. Leru la SandBlast - lifaele li romelloa ho hlahlojoa ho leru la Check Point.

1. Analysis ea malware sebelisa Check Point forensics. SandBlast Network

Lebokose la lehlabathe le ka nkoa e le mohala oa ho qetela oa tšireletso sebakeng sa marang-rang. E hokela feela ka mor'a tlhahlobo ka mekhoa ea khale - antivirus, IPS. 'Me haeba lisebelisoa tse joalo tsa ho saena tsa setso li sa fane ka li-analytics, joale lebokose la lehlabathe le ka "bolella" ka botlalo hore na ke hobane'ng ha faele e ne e koetsoe le hore na e etsa eng e kotsi. Tlaleho ena ea forensics e ka fumanoa ho tsoa ho sandbox ea lehae le ea maru.

Sheba Tlaleho ea Forensics ea Point

Ha re re uena, joalo ka setsebi sa ts'ireletso ea tlhahisoleseling, u tlile mosebetsing mme oa bula dashboard ho SmartConsole. Hang-hang u bona liketsahalo tsa lihora tse 24 tse fetileng mme tlhokomelo ea hau e huleloa liketsahalong tsa Threat Emulation - litlhaselo tse kotsi ka ho fetisisa tse sa kang tsa thibeloa ke tlhahlobo ea matsoho.

1. Analysis ea malware sebelisa Check Point forensics. SandBlast Network

U ka "theola" liketsahalong tsena 'me u bone lintlha tsohle tsa lehare la Threat Emulation.

1. Analysis ea malware sebelisa Check Point forensics. SandBlast Network

Ka mor'a sena, o ka sefa lits'oants'o ka ho fetesisa ka boemo ba ts'okelo ea ts'okelo (Bothata), hammoho le ka Boemo ba Kholiseho (ho tšepahala ha karabelo):

1. Analysis ea malware sebelisa Check Point forensics. SandBlast Network

Ha re se re atolositse ketsahalo eo re e ratang, re ka tloaelana le lintlha tse akaretsang (src, dst, severity, moromelli, joalo-joalo):

1. Analysis ea malware sebelisa Check Point forensics. SandBlast Network

Mme moo o ka bona karolo Forensics e fumanehang Summary tlaleha. Ho tobetsa ho eona ho tla bula tlhahlobo e qaqileng ea malware ka mokhoa oa leqephe le sebetsang la HTML:

1. Analysis ea malware sebelisa Check Point forensics. SandBlast Network
(Ena ke karolo ea leqephe. Ea mantlha e ka shejoa mona)

Ho tsoa tlalehong e tšoanang, re ka khoasolla malware a mantlha (ka polokelong e sirelelitsoeng ka password), kapa hang-hang ikopanye le sehlopha sa karabo ea Check Point.

1. Analysis ea malware sebelisa Check Point forensics. SandBlast Network

Ka tlase u ka bona popae e ntle e bonts'ang ka liperesente tse seng li ntse li tseba khoutu e mpe eo mohlala oa rona o tšoanang ka eona (ho kenyeletsoa khoutu ka boeona le macros). Litlhahlobo tsena li fanoa ho sebelisoa ho ithuta ka mochini ho Check Point Threat Cloud.

1. Analysis ea malware sebelisa Check Point forensics. SandBlast Network

Joale u ka bona hantle hore na ke mesebetsi efe ka har'a sandbox e re lumelletseng ho etsa qeto ea hore faele ena e kotsi. Tabeng ena, re bona tšebeliso ea mekhoa ea bypass le teko ea ho khoasolla ransomware:

1. Analysis ea malware sebelisa Check Point forensics. SandBlast Network

Ho ka hlokomeloa hore tabeng ena, ho ne ho etsisoa mekhoa e 'meli (Win 7, Win XP) le liphetolelo tse fapaneng tsa software (Ofisi, Adobe). Ka tlase ho na le video (pontšo ea li-slide) ka mokhoa oa ho bula faele ena ka lebokoseng la lehlabathe:

1. Analysis ea malware sebelisa Check Point forensics. SandBlast Network

Mohlala oa video:

1. Analysis ea malware sebelisa Check Point forensics. SandBlast Network

Qetellong re ka bona ka ho qaqileng hore na tlhaselo eo e ile ea qala joang. E ka ba ka mokhoa oa tabular kapa ka litšoantšo:

1. Analysis ea malware sebelisa Check Point forensics. SandBlast Network

Ha re le moo re ka khoasolla tlhahisoleseling ena ka sebopeho sa RAW le faele ea pcap bakeng sa litlhahlobo tse qaqileng tsa sephethephethe se hlahisitsoeng Wireshark:

1. Analysis ea malware sebelisa Check Point forensics. SandBlast Network

fihlela qeto e

U sebelisa boitsebiso bona, u ka matlafatsa tšireletso ea marang-rang ea hau haholo. Thibela baphatlalatsi ba kabo ea vaerase, ho koala likotsi tse sebelisitsoeng hampe, thibela maikutlo a ka bang teng ho tsoa ho C&C le tse ling tse ngata. Tlhahlobo ena ha ea lokela ho hlokomolohuoa.

Lihloohong tse latelang, ka ho tšoanang re tla sheba litlaleho tsa Moemeli oa SandBlast, SnadBlast Mobile, hammoho le CloudGiard SaaS. Kahoo lula u mametse (thelekramo, Facebook, VK, TS Solution Blog)!

Source: www.habr.com

Eketsa ka tlhaloso