【蓝队】恶意文件分析工具

$ capa.exe suspicious.exe -vv...execute shell command and capture outputnamespace   c2/shellauthor      [email protected]scope       functionatt&ck      Execution::Command and Scripting Interpreter::Windows Command Shell [T1059.003]references  https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/ns-processthreadsapi-startupinfoafunction @ 0x4011C0  and:    match: create a process with modified I/O handles and window @ 0x4011C0      and:        number: 257 = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW @ 0x4012B8        or:          number: 68 = StartupInfo.cb (size) @ 0x401282        or: = API functions that accept a pointer to a STARTUPINFO structure          api: kernel32.CreateProcess @ 0x401343    match: create pipe @ 0x4011C0      or:        api: kernel32.CreatePipe @ 0x40126F, 0x401280    optional:      match: create thread @ 0x40136A, 0x4013BA        or:          and:            os: windows            or:              api: kernel32.CreateThread @ 0x4013D7        or:          and:            os: windows            or:              api: kernel32.CreateThread @ 0x401395    or:      string: "cmd.exe" @ 0x4012FD...

rule:  meta:    name: hash data with CRC32    namespace: data-manipulation/checksum/crc32    authors:      - [email protected]    scope: function    mbc:      - Data::Checksum::CRC32 [C0032.001]    examples:      - 2D3EDC218A90F03089CC01715A9F047F:0x403CBD      - 7D28CB106CB54876B2A5C111724A07CD:0x402350  # RtlComputeCrc32      - 7EFF498DE13CC734262F87E6B3EF38AB:0x100084A6  features:    - or:      - and:        - mnemonic: shr        - or:          - number: 0xEDB88320          - bytes: 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E = crc32_tab        - number: 8        - characteristic: nzxor      - and:        - number: 0x8320        - number: 0xEDB8        - characteristic: nzxor      - api: RtlComputeCrc32