Red team value: understand how samples are analyzed → know which characteristics are exposed → improve evasion and OPSEC
⛔ In-depth reference
- Detailed PE/ELF static analysis commands and scripts → references/static-analysis.md
- Dynamic analysis and sandbox evasion → references/dynamic-analysis.md
Phase 0: Sample handling and safety preparation
⛔ NEVER Execute samples in a non-isolated environment!
# 计算哈希
sha256sum sample.bin
md5sum sample.bin
file sample.bin strings -n 6 sample.bin | head -50
Check whether it is packedupx -t sample.bin # UPX die sample.bin # Detect It Easy
决策：
Sample type? ├─ PE (Windows) → Phase 1A ├─ ELF (Linux) → Phase 1B ├─ Mach-O (macOS) → Phase 1C ├─ Shellcode/memory dump → Phase 2 (direct dynamic analysis) └─ Scripts (PS1/VBS/JS/Python) → directly read the code statically
## Phase 1A: PE 静态分析
```bash
# PE 头信息
python3 -c "
import pefile
pe = pefile.PE('sample.exe')
print(f'Compiled: {pe.FILE_HEADER.TimeDateStamp}')
print(f'Sections: {len(pe.sections)}')
for s in pe.sections:
print(f' {s.Name.decode().strip(chr(0)):8} Entropy:{s.get_entropy():.2f} VSize:{s.Misc_VirtualSize}')
print(f'Imports: {len(pe.DIRECTORY_ENTRY_IMPORT)}')
for entry in pe.DIRECTORY_ENTRY_IMPORT:
print(f' {entry.dll.decode()}')
"
Key Import characteristic mapping:
| Import API | Function inference |
|---|---|
| VirtualAlloc + WriteProcessMemory | Process injection |
| CreateRemoteThread | Remote thread injection |
| WinHttpOpen / InternetOpenA | Network communication/C2 |
| CryptEncrypt / BCryptEncrypt | Encryption (possibly ransomware) |
| RegSetValueEx + RunKey | Persistence |
| NtQueryInformationProcess | Anti-debugging |
| IsDebuggerPresent | Anti-debugging |
| GetTickCount / QueryPerformanceCounter | Sandbox detection |
Phase 1B: ELF static analysis
readelf -h sample # ELF 头
readelf -S sample # 节表
readelf -d sample # 动态链接
nm sample 2>/dev/null # 符号表（未 strip 时）
# 高熵节 = 可能加密/压缩
python3 -c "
from elftools.elf.elffile import ELFFile
import math
from collections import Counter
with open('sample','rb') as f:
elf = ELFFile(f)
for s in elf.iter_sections():
data = s.data()
if len(data) > 100:
entropy = -sum((c/len(data))*math.log2(c/len(data)) for c in Counter(data).values())
if entropy > 7.0:
print(f'[!] 高熵: {s.name} entropy={entropy:.2f}')
"
Phase 2: Dynamic analysis decision
目标：观察样本运行时行为
├─ 有沙箱环境 → 直接投递（AnyRun/Cuckoo/CAPE）
├─ 本地 VM → strace/procmon + 网络抓包
└─ 仅有样本无法执行 → 纯静态（Ghidra/IDA）
Windows dynamic analysis:
1. Procmon 过滤进程名 → 文件/注册表/网络操作
2. Wireshark/fakenet → C2 通信
3. API Monitor → 关键 API 调用序列
Linux dynamic analysis:
strace -f -e trace=network,process,file -o trace.log ./sample
ltrace -f -o ltrace.log ./sample
# 另一终端监控
ss -tlnp # 监听端口
ss -tnp # 外连
Phase 3: IOC extraction checklist
⛔ All of the following types of IOCs must be extracted:
- File hashes (MD5 + SHA256)
- Network indicators (IP/domain/URL/URI path)
- File system indicators (created/modified file paths)
- Registry indicators (Windows)
- Process indicators (process name, command line, parent-child relationship)
- Persistence mechanisms (startup items/scheduled tasks/services/cron)
- MITRE ATT&CK TTP mapping
Phase 4: Red team reflection (OPSEC review)
After analysis is complete, reflect from the red team perspective:
该样本暴露了哪些特征？
├─ 静态特征 → 特定字符串/Import/节名/编译时间
├─ 行为特征 → 进程注入方式/持久化手法/C2 模式
├─ 网络特征 → User-Agent/URI 模式/心跳间隔
└─ 内存特征 → 未加密字符串/固定 XOR key/特征字节序列
→ Used to improve the evasion design of one's own tools
Tool quick reference
| Purpose | Tool |
|---|---|
| PE analysis | pefile, pestudio, CFF Explorer |
| ELF analysis | readelf, pyelftools, radare2 |
| Decompilation | Ghidra, IDA Pro, Binary Ninja |
| String extraction | FLOSS (FireEye), strings |
| Sandbox | AnyRun, CAPE, Cuckoo |
| Network | Wireshark, FakeNet-NG |
| YARA | yara-python, yarGen |