Quick malware analysis during incidents

During security incidents due to malware infections, it is required to act fast and identify the malware behavior and take actions. However analyzing malware may takes time ,especially if considering that antiviruses cannot detect new well-crafted malwares.

To quickly analyses a suspicious file to identify if it a malware or not and understand its behavior, the following quick actions can be taken

1-upload the file to virustotal

Virustotal.com will check if the file detected by any of the antiviruses rather the one installed. In this case the antivirus vendor may contacted to produce a signature for the malware

2-upload the file to anubis and malwr

Both sites will analyze the file behavior and will indicate if it is a malware or not. Comparing results

Also the analysis will help taking necessary action such as removing the virus, blocking access to its C&C, produce IDS/IPS signature etc.

These 2 actions are very simple but when there is no time or tools in place remeber that these actions will be the last resort.

C&C traffic , TOR network the new media

A new research by GData Software researchers, Identified a C&C server for a botnet hidden in TOR network.

Their blog is excellent where they described the 2 C&C traffic medias are being used by Botnets and the new media using TOR. I highly recommend reading it and establish an approach to detect and stop such traffic.

Enjoy reading:
Botnet command server hidden in Tor

Digital Forensics Procedure- Quick thought

Always follow a propoer Digital Forensics Procedure, many can be found on the internet but for guidance one of the following can be used:
 
SANS Digital Forensics and Incident Response Poster
Forensic Process Lifecycle

Always remober because you are responsible for an evidence, it means you have to show "chain of custody" by following proper procedure and protect the integrity of an evidence all the way to its dispostion.