The brbbot.exe creates a config temp file in the Windows VM which we found from Noriben logs.The Windows VM tries connecting with the C2 server 185.84.108.23280 to receive further instruction.Brbbot.exe is observed making connections to by] for DNS resolution.In the real world, malware would have connected with the C2 server to download further instructions to perform malicious activity.įrom our static and dynamic analysis, below is a list of malware’s behaviour on a Windows VM,.The Windows VM tries to connect the C2 IP(in this case Ubuntu VM’s IP) by initiating a TCP handshake.The INetsim is responding to the DNS request with Ubuntu VM’s IP as DNS response.As we expected the malware is making an outbound connection to a C2 server by].The file command utility used here and it shows its PE executable file. Checking the file type confirms if it’s a PE(Portable Executable) or if it’s of any other format.Few tools to check a file type are PE studio, CFF Explorer, ExifTool Malware authors often rename the binary with other extensions to trick the user into clicking them. To begin with, the malware file type should be tested regardless of what it displays. Virustotal → to check the reputation of hashes and malware attributes.Pe studio → To see imports/ functions of an executable.Strings → To extract strings from sample.

md5sum/sha1sum → To generate a hash of sample.To perform static analysis I’m using the below list of tools. Note: The Ubuntu VM is acting as the internet gateway for the Windows VM, to capture the network traffic. The base system is macOS and inside the virtual machine I have Windows 10 for malware execution and Ubuntu for analysis. We will determine the malware’s activities on the machine, locations to inspect and a brief on tools that’ll be used to analyze the sample. In this exercise, We’ll be performing static and dynamic analysis of brbbot.exe malware to understand it’s behaviour by analyzing it’s sample and as an outcome creating a signature to detect it.

Wireshark download cnet