Itusilẹ ti REMnux 7.0, pinpin itupalẹ malware kan

Odun marun niwon awọn atejade ti o kẹhin atejade akoso itusilẹ tuntun ti pinpin Linux pataki kan REM nux 7.0, ti a ṣe lati ṣe iwadi ati yiyipada koodu malware ẹlẹrọ. Lakoko ilana itupalẹ, REMnux ngbanilaaye lati pese agbegbe yàrá ti o ya sọtọ ninu eyiti o le ṣe apẹẹrẹ iṣẹ ti iṣẹ nẹtiwọọki kan labẹ ikọlu lati ṣe iwadi ihuwasi ti malware ni awọn ipo ti o sunmọ awọn ti gidi. Agbegbe miiran ti ohun elo ti REMnux jẹ iwadi ti awọn ohun-ini ti awọn ifibọ irira lori awọn oju opo wẹẹbu ti a ṣe ni JavaScript.

Pinpin naa jẹ ipilẹ lori ipilẹ package Ubuntu 18.04 ati lo agbegbe olumulo LXDE. Firefox wa pẹlu afikun NoScript bi ẹrọ aṣawakiri wẹẹbu kan. Ohun elo pinpin pẹlu yiyan pipe pipe ti awọn irinṣẹ fun itupalẹ malware, awọn ohun elo fun koodu imọ-ẹrọ yiyipada, awọn eto fun kikọ PDFs ati awọn iwe aṣẹ ọfiisi ti a yipada nipasẹ awọn ikọlu, ati awọn irinṣẹ fun iṣẹ ṣiṣe abojuto ninu eto naa. Iwọn aworan bata REMnux, ti a ṣẹda fun ifilọlẹ inu awọn ọna ṣiṣe agbara, o jẹ 5.2 GB. Ninu itusilẹ tuntun, gbogbo awọn irinṣẹ ti a funni ti ni imudojuiwọn, akopọ ti pinpin ti pọ si ni pataki (iwọn ti aworan ẹrọ foju ti ilọpo meji). Atokọ awọn ohun elo ti a dabaa ti pin si awọn ẹka.

Awọn kit pẹlu awọn wọnyi irinṣẹ:

• Itupalẹ oju opo wẹẹbu: Olutayo, mitmproxy, Network Miner Free Edition, ọmọ-iwe, wget, Burp aṣoju Free Edition, Aládàáṣiṣẹ, pdnstool, Tor, tcpextract, tcpflow, palolo.py, CapTipper, yaraPcap.py;
• Itupalẹ ti awọn fidio Flash irira: xxxswf, Awọn irinṣẹ SWF, RABCDAsm, jade_swf, Ipalara;
• Itupalẹ Java: Java kaṣe IDX Parser, JD-GUI Java Decompiler, JAD Java Decompiler, Javassist, CFR;
• Itupalẹ JavaScript: Agbanrere Debugger, ExtractScripts, SpiderMonkey, V8, JS Beautifier;
• Itupalẹ PDF: Ṣe itupalẹ PDF, Pdfobjflow, pdfid, pdf-parser, peepdf, Origami, PDF X-RAY Lite, pdftk, swf_mastah, qpdf, pdfjinde;
• Onínọmbà ti awọn iwe aṣẹ Microsoft Office: officeparser, pyOLEScanner.py, oletools, libolecf, oledump, emldump, MSGIyipada, base64dump.py, nọmba;
• Itupalẹ Shellcode: idanwo, unicode2hex-sa, unicode2raw, dism-eyi, shellcode2exe;
• Mu ifọju wa sinu fọọmu kika (deobfuscation): unXOR, XORSstrings, ex_pe_xor, XORSearch, brxor.py, xortool, NoMoreXOR, XORBruteForcer, Balbuzard, ÀWỌN TOSL.
• Yiyọ data okun jade: strdeobj, kokoro, okun;
• Imularada faili: Ṣaaju, Irun ori, olopobobo_extractor, Chopper;
• Abojuto iṣẹ nẹtiwọki: Wireshark, ngrep, Idasonu TCP, tcpick;
• Awọn iṣẹ nẹtiwọki: Airotẹlẹ DNS, Nginx, iroMail, Oyin, INetSim, Ṣe atilẹyin IRCd, OpenSSH, gba-gbogbo-ip;
• Awọn ohun elo nẹtiwọki: lẹwaping.sh, ṣeto-aimi-ip, sọtun-dhcp, netcat, Onibara EPIC IRC, iyalẹnu, Just-Metadata;
• Nṣiṣẹ pẹlu akojọpọ awọn apẹẹrẹ malware: Maltrive, Ragpicker, Omiran, MASTIFF, Sikaotu iwuwo;
• Itumọ awọn ibuwọlu: Yara Generator, IOCextractor, Ilana adaṣe, Olootu Ofin, ioc-parser;
• Ṣiṣayẹwo: Egbo, ClamAV, Akoj, ExifTool, virustotal-fi, Disitool;
• Ṣiṣẹ pẹlu hashes: nsrllookup, Aládàáṣiṣẹ, Hash Idanimọ, lapapọhash, ss jin, virus lapapọ-wa, VirusTotalApi;
• Itupalẹ malware Linux: Sysdig, Ko kuro
• Awọn olutọpa: Vivisect, Udis86, objdump;
• Awọn olutọpa: Evan's Debugger (EDB), Olutukokoro ise agbese GNU (GDB);
• Awọn ọna ṣiṣe wiwapa: okun, ltrace
• Ṣewadii: Radare 2, Pyew, bokken, m2elf, ELF Parser;
• Nṣiṣẹ pẹlu data ọrọ: SciTE, Geany, Mo ti wá;
• Ṣiṣẹ pẹlu awọn aworan: feh, ImageMagick;
• Nṣiṣẹ pẹlu awọn faili alakomeji: wxHexEditor, VBinDiff;
• Iṣayẹwo idalẹnu iranti: Ilana Volatility, awọn wiwa, AESKeyFinder, RSAKeyFinder, VolDiff, Ranti, linux_mem_diff_tool;
• Onínọmbà ti awọn faili PE ti o ṣiṣẹ UPX, Bytehist, Sikaotu iwuwo, PackerID, objdump, Udis86, Vivisect, Awọn ami ami, pescanner, ExeScan, enp, Peframe, pedump, bokken, RATDecoders, Pyew, kika.py, PyInsitola Extractor, DC3-MWCP;
• Iṣiro malware fun awọn ẹrọ alagbeka: Androwarn, AndroGuard.

orisun: opennet.ru