Analyze malware sites with Malzilla...

General Topics
1

Hi malware fighters,

You can find it here: http://malzilla.sourceforge.net/

polonus

2

Downloaded and installed … thanks, Polonus. :slight_smile:

3

Nice find Pol, seems to be quite useful.

You will still have to jump through a few hoops though as avast! will alert on it’s temp files, and also block some access to sites…(web/network shield)

A good addition to the arsenal though :slight_smile:

Thanks,

-Scott-

4

Hi spg SCOTT,

I would never have found out without malzilla what I found here, re: http://forum.avast.com/index.php?topic=55993.msg473295#msg473295

There malzilla is a great help because on giving in hxtp://www.talkradio.net with a get query it immediately reports/flags a redirect to htxp://www.talk.radio.net/?273147948
This redirect I did not allow malzilla to go to but I searched this PID 273147948 stood for which was then leading me here: sohu dot com dot cn with a suspicious inline script found by Unmask Parasites that and next on Norton_Safe_Web online i found 4 heuristic viruses and one trojan. I would never have found all this out without the sandboxed malzilla combined with a bit of logical googling from my part. A really helpful tool for the malware analysts among us here indeed, some documentation here:

http://wikisecure.net/security/malzilla-documentation-for-web-based-malware-detection

pol

5

Hi users of the malware hunting tool malzilla.

Another manual:
http://holisticinfosec.org/toolsmith/docs/july2009.html

polonus (malware fighter)

6

Thanks Pol. The documentation looks helpful too for someone like me. It seems not so long ago that I was still engaged in hand to hand combat with malware infections. The forum has been of immense help in bringing me up to another level. I’ll make sure to put some time aside to familiarise myself with this tool.

Sorry x-posted

7

Thanks so very much Polonus. Great find. ^.^

8

Hi malware fighters,

And for the linux friends malzilla is called malheur: http://packetstormsecurity.org/filedesc/malheur-0.4.7.tar-gz.html

polonus

9

Hi malware fighters,

For those that know about the risks and the propper setting of the environment and the precautions, re: http://www.sans.org/reading_room/whitepapers/threats/malware_analysis_environment_design_and_artitecture_1841

then here some further information on malware analysis:

Capture, care and analysis of Malware made easy
http://www.linklogger.com/vm_capture.htm

Practical Malware Analysis
http://www.blackhat.com/presentations/bh-dc-07/Kendall_McMillan/Presentation/bh-dc-07-Kendall_McMillan.pdf

Setting up Windbg/VMWare:

Remote Debugging using VMWare
http://www.catch22.net/tuts/vmware

Driver Debugging with WinDbg and VMWare
http://silverstr.ufies.org/lotr0/windbg-vmware.html

Links courtesy of “Kayaker”

On an automated malware analysis environment:
http://cert.at/downloads/papers/mass_malware_analysis_en.html

Also how Detect virtual machines :

www.symantec.com/avcenter/reference/Virtual_Machine_Threats.pdf

This all makes an interesting read,

polonus

10

Hi malware fighters,

Additionally some tools:
http://www.woodmann.com/collaborative/tools/index.php/Category:.NET_Tools
Caution if analyzing malware, note that malware tries to infest an Operational System, so within a virtual machine and with all precautions taken, there is still a risk, it can be a calculated risk, but there is a risk too “hoop” your machine. So this is an explicit warning for those who will work malzilla VM,

polonus

11

Hi malware fighters,

Also for instructions and look-ups on malware, go here:
http://www.offensivecomputing.net/?q=node/505

polonus