Ho lokolloa ha REMnux 7.0, phepelo ea tlhahlobo ea malware

Lilemo tse hlano ho tloha ha ho phatlalatsoa khatiso ea ho qetela thehoa tokollo e ncha ea kabo e khethehileng ea Linux Tlosa 7.0, e etselitsoeng ho ithuta le ho khutlisa khoutu ea malware ea moenjiniere. Nakong ea ts'ebetso ea tlhahlobo, REMnux e u lumella ho fana ka tikoloho e ka thoko ea laboratori eo ho eona u ka etsisang ts'ebetso ea ts'ebeletso e itseng ea marang-rang e hlaseloang ho ithuta boitšoaro ba malware maemong a haufi le a nnete. Karolo e 'ngoe ea ts'ebeliso ea REMnux ke ho ithuta ka thepa ea ho kenya hampe liwebsaeteng tse kentsoeng ho JavaScript.

Kabo e hahiloe motheong oa sephutheloana sa Ubuntu 18.04 mme e sebelisa tikoloho ea mosebelisi ea LXDE. Firefox e tla le kenyelletso ea NoScript joalo ka sebatli sa marang-rang. Setsi sa kabo se kenyelletsa khetho e felletseng ea lisebelisoa tsa ho sekaseka malware, lisebelisoa bakeng sa khoutu ea boenjiniere e khutlisetsang morao, mananeo a ho ithuta li-PDF le litokomane tsa ofisi tse fetotsoeng ke bahlaseli, le lisebelisoa tsa ho lekola ts'ebetso ea sistimi. Boholo setšoantšo sa boot REMnux, e entsoeng bakeng sa lonthja ka har'a litsamaiso tsa virtualization, ke 5.2 GB. Tokollong e ncha, lisebelisoa tsohle tse fanoeng li ntlafalitsoe, sebopeho sa kabo se atolositsoe haholo (boholo ba setšoantšo sa mochini oa sebele bo imenne habeli). Lethathamo la lisebelisoa tse reriloeng le arotsoe ka mekhahlelo.

The kit e kenyelletsa tse latelang liletsa:

• Tlhahlobo ea sebaka sa Marang-rang: morusu, mitmproxy, Network Miner Free Edition, sekonopo, Hlakola, Khatiso ea mahala ea Burp Proxy, Mosebelisi, pdnstool, Tor, tcpextract, tcpflow, passive.py, CapTipper, yaraPcap.py;
• Tlhahlobo ea livideo tse kotsi tsa Flash: xxswf, Lisebelisoa tsa SWF, RABCDAsm, ntsha_swf, Lula;
• Tlhahlobo ea Java: Java Cache IDX Parser, JD-GUI Java Decompiler, JAD Java Decompiler, Setsebi sa Javassist, CFR;
• Tlhahlobo ea JavaScript: Rhino Debugger, ExtractScripts, SpiderMonkey, V8, JS Beautifier;
• Tlhahlobo ea PDF: AnalysePDF, Pdfobjflow, pdfid, pdf-parser, peepdf, Tšimolohong, PDF X-RAY Lite, EA-PDFtk, swf_mastah, qpdf, pdf tsosa;
• Tlhahlobo ea litokomane tsa Microsoft Office: ofisiri, pyOLEScanner.py, lisebelisoa tsa oli, libolecf, oledump, emldump, MSGConvert, base64dump.py, unicode;
• Shellcode analysis: sctest, unicode2hex-escaped, unicode2raw, dism-sena, shellcode2exe;
• Ho tlisa obfuscation ka mokhoa o balehang (deobfuscation): unXOR, XORStrings, ex_pe_xor, XORBatla, brxor.py, xortool, NoMoreXOR, XORBruteForcer, Balbuzard, LIEKETSENG
• Ho ntša lintlha tsa likhoele: strdeobj, pestr, likhoele;
• Fumana faele: Ka pele-pele, scalpel, bulk_extractor, Chopper;
• Tlhokomelo ea mesebetsi ea marang-rang: Wireshark, ngrep, TCP Thotobolo, tcpick;
• Litšebeletso tsa marang-rang: FakeDNS, Nginx, fakeMail, Mahe a linotsi, INetSim, Khothalletsa IRCd, OpenSSH, amohela-tsohle-ips;
• Lisebelisoa tsa marang-rang: monate.sh, set-static-ip, renew-dhcp, netcat, EPIC IRC Client, e tsitsitseng, Feela-Metadata;
• Ho sebetsa le pokello ea mehlala ea malware: Matrieve, Ragpicker, Viper, MATŠOELE, Density Scout;
• Tlhaloso ea mesaeno: Jenereithara ea Yara, IOCextractor, Autorule, Mohlophisi oa Molao, ioc-parser;
• Ho hlahloba: o yara, ClamAV, Trid, ExifTool, virustotal-romela, Disitool;
• Ho sebetsana le li-hashes: nsrllookup, Mosebelisi, Sekhetho sa Hash, totalhash, ssdeep, virustotal-batla, VirusTotalApi;
• Tlhahlobo ea malware ea Linux: Sysdig, E sa ts'oaneng
• Li-disassembler: Vivisect, Udis86, objdump;
• Li-debugger: Evan's Debugger (EDB), GNU Project Debugger (GDB);
• Sistimi ea ho ts'oara: strace, ltrace
• Fuputsa: Radare 2, Pyew, bokken, m2ke, ELF Parser;
• Ho sebetsa ka data ea mongolo: SciTE, Se-Geany, ke ile ka;
• Ho sebetsana le litšoantšo: feh, ImageMagick;
• Ho sebetsana le lifaele tsa binary: wxHexEditor, VBinDiff;
• Tlhahlobo ea ho lahla memori: Sekhahla sa Volatility, tse fumanoang, AESKeyFinder, RSAKeyFinder, VolDiff, Rekall, Linux_mem_diff_tool;
• Tlhahlobo ea lifaele tsa PE tse sebetsang UPX, Molaetsa oa boikaketsi, Density Scout, PackerID, objdump, Udis86, Vivisect, Signsrch, pescanner, ExeScan, pev, Peframe, pedump, bokken, RATDecoders, Pyew, balape.py, PyInstaller Extractor, DC3-MWCP;
• Tlhahlobo ea Malware bakeng sa lisebelisoa tsa mohala: Androwarn, AndroGuard.

Source: opennet.ru