Monday, 22 April 2013

VirusTotal += PCAP Analyzer

VirusTotal is a greedy creature, one of its gluttonous wishes is to be able to understand and characterize all the races it encounters, it already understood the insurgent collective of Portable Executables, the greenish creatures known as Android APKs, the talkative PDF civilization, etc. as of today it also figures out PCAPs, a rare group of individuals obsessed with recording everything they see.

PCAP files contain network packet data created during a live network capture, often used for packet sniffing and analyzing data network characteristics. In the malware research field PCAPs are often used to:

  • Record malware network communication when executed in sandboxed environments.
  • Record honeyclient browser exploitation traces.
  • Log network activity seen by network appliances and IDS.
  • etc.
We have seen that many users send their PCAPs to VirusTotal, these PCAPs often contain HTTP flows whereby a trojan is downloaded, recording worm scanning sweeps, logging exploits being delivered to a honeymonkey, etc. We want to help those users submitting PCAPs to VirusTotal and improve their research, that is why we have introduced PCAP analysis, its features are:
  • Processes the files with popular intrusion detection systems (Snort and Suricata for the moment) and logs the rules that they trigger.
  • Extracts file metadata with Wireshark.
  • Lists DNS resolutions performed.
  • Lists HTTP communication.
  • Extracts files seen in the different network flows and links to the pertinent VirusTotal reports if the given file is of an interesting file type (portable executables, PDFs, flash, compressed bundles, etc.). If you are registered in VirusTotal Community and have signed in, these interesting files extracted from the network flow will be available for you to download as long as you are the first submitter of the PCAP (which when dealing with this type of files is the most common situation). 
Without futher ado, let us paste a couple of examples of this new functionality (refer to the File details tab in order to see all of the aforementioned information):




16 comments:

  1. Hi Emiliano, great job!
    Is it possible to anonymize the network flow in order to maintain the anonymity of the network where the flow is captured?

    ReplyDelete
  2. Kudos to Francisco Santos for this great feature (https://www.virustotal.com/en/about/team/), @fsantos do you want to chime in with respect to the previous anonymization request?

    ReplyDelete
  3. [2] Kudos to Francisco Santos // @fsantos

    in the past has ridden labs to perform exactly this type of analysis, see this at your fingertips to analyze is very tempting!

    Effectively, congratzzz!!

    ReplyDelete
  4. Hi! you could use tcprewrite (http://tcpreplay.synfin.net/) tool to modify IP address belonging to your origin net, for example:

    $ tcprewrite -C -S (YOURIPRANGE)/16:10.0.0.0/16 -D (YOURIPRANGE)/16:10.0.0.0/16 -i input.pcap -o output.pcap

    Keep in mind this will only modify IP address, any information traveling inside this packets will be unmodified and information about the original hosts could be eventually revealed depending on information from other protocols.

    ReplyDelete
  5. Why Snort are running with the SourceFire rules and Suricata with the EmergintThreats plus the GPL rules? Why not just one IDS with both rulesets?

    To generate alerts from preprocessors of both IDS? For the file extraction feature that have Suricata?

    Also, it has uncommented all the rules from both rulesets? (some FPs will be generated but it's useful)

    ReplyDelete
  6. Good and nice post.....

    Thanks & regards

    ReplyDelete
  7. http://www.animezat.com
    http://www.animezat.com/

    ReplyDelete
  8. So how do I use it? Just upload a .pcal file using the file upload capability? I uploaded a pcap file but it looks like it did just a regular virus scan, even though it recognized it as a packet capture.

    ReplyDelete
  9. Awesome work, VirusTotal. I was wondering what the new "Relationships" tab was. Once I dove in, I was blown away! Truly impressive craftsmanship going on here. I take great satisfaction in submitting fresh malware URLs and binaries to VirusTotal.

    ReplyDelete
  10. This comment has been removed by the author.

    ReplyDelete
  11. It's a great job!!! I usually needed to manage my own Snort (expending time on it) in order to discover the attack or the infection. It's really useful your framework for discovering the URL requested, DNS requested and analyze de .pcap with Snort and Suricata.

    However, It's the first step for analyzing the .pcap. Then, we always need to open it with our pcap reader like Wireshark.

    ReplyDelete
  12. Very impressive. You could perform the work of an Intrusion Analyst from this interface alone.

    I am digging the tools and use of Snort to analyze pcaps.

    ReplyDelete
  13. VigRx:http://www.hikanpou.com/product/VigRx.html
    D10催情剤:http://www.hikanpou.com/product/D10.html
    花痴:http://www.hikanpou.com/product/花痴.html
    威哥王:http://www.hikanpou.com/product/威哥王.html
    巨人倍増:http://www.hikanpou.com/product/巨人倍増.html
    淫インモラル:http://www.hikanpou.com/product/immoral.html
    インモラル:http://www.hikanpou.com/product/immoral.html
    妖姫:http://www.hikanpou.com/product/youhi.html
    RU486:http://www.hikanpou.com/product/RU486.html
    紅蜘蛛:http://www.hikanpou.com/product/紅蜘蛛.html
    D10:http://www.hikanpou.com/product/D10.html
    D10媚薬:http://www.hikanpou.com/product/D10.html
    三鞭粒:http://www.hikanpou.com/product/weige.html
    絶對高潮:http://www.hikanpou.com/product/絶對高潮.html
    FLY D5:http://www.hikanpou.com/product/蒼蝿水.html
    D5原液:http://www.hikanpou.com/product/蒼蝿水.html
    蒼蝿水:http://www.hikanpou.com/product/魔力蒼蝿水5.html
    三便宝:http://www.hikanpou.com/product/三便宝.html
    蟻力神:http://www.hikanpou.com/product/蟻力神1.html
    三體牛鞭:http://www.hikanpou.com/product/三体牛鞭.html
    三体牛鞭:http://www.hikanpou.com/product/三体牛鞭.html
    勃動力三體牛鞭:http://www.hikanpou.com/product/三体牛鞭.html
    狼1号:http://www.hikanpou.com/product/狼1号.html
    狼一号:http://www.hikanpou.com/product/狼1号.html
    五便宝:http://www.hikanpou.com/product/五便宝.html
    男宝:http://www.hikanpou.com/product/男宝5箱.html
    蔵八宝:http://www.hikanpou.com/product/蔵八宝.html
    新一粒神:http://www.hikanpou.com/product/新一粒神.html
    リドスプレー:http://www.hikanpou.com/product/LIDOSPRAY.html
    ビグレックス:http://www.hikanpou.com/product/VigRx.html
    vigrxプラス:http://www.hikanpou.com/product/VigRx.html
    Wenickman:http://www.hikanpou.com/product/Wenickman.html
    MaxMan:http://www.hikanpou.com/product/MaxMan.html
    情愛芳香劑:http://www.hikanpou.com/product/rush724.html
    壮天根:http://www.hikanpou.com/product/壮天根.html
    魔根:http://www.hikanpou.com/product/魔根金中草.html
    夜夜堅:http://www.hikanpou.com/product/夜夜堅.html
    壮陽一号:http://www.hikanpou.com/product/壮陽一号.html
    マカ:http://www.hikanpou.com/product/MACA.html
    黒倍王:http://www.hikanpou.com/product/黒倍王.html
    花之欲:http://www.hikanpou.com/product/花之欲.html
    美人豹:http://www.hikanpou.com/product/美人豹5.html
    妻之友:http://www.hikanpou.com/product/妻之友.html
    福源春:http://www.hikanpou.com/product/福源春.html
    蟻王:http://www.hikanpou.com/product/アリ王蟻王,ANTKING.html
    アリ王:http://www.hikanpou.com/product/アリ王蟻王,ANTKING.html
    SEX DROPS:http://www.hikanpou.com/product/SEXDROPS5.html
    片仔廣:http://www.hikanpou.com/product/片仔廣.html
    へんしこう:http://www.hikanpou.com/product/片仔廣.html
    維尼好:http://www.hikanpou.com/product/維尼好消毒液.html
    縮陰膏:http://www.hikanpou.com/product/縮陰膏.html
    牛黄清心丸:http://www.hikanpou.com/product/牛黄清心丸.html
    同仁堂牛黄清心丸:http://www.hikanpou.com/product/牛黄清心丸2.html
    消渇丸:http://www.hikanpou.com/product/消渇丸.html
    999皮炎平:http://www.hikanpou.com/product//999皮炎平.html
    同仁烏鶏白鳳丸:http://www.hikanpou.com/product/烏鶏白鳳丸.html
    婦科千金片:http://www.hikanpou.com/product/婦科千金片.html
    セフラジン:http://www.hikanpou.com/product/cefradine.html
    終極痩身:http://www.hikanpou.com/product/zhongjishoushen.html
    天天素:http://www.hikanpou.com/product/天天素.html
    スーパーファット:http://www.hikanpou.com/product/スーパーファットNEWSUPERFATBURNIN.html
    SPANISCHE FLIEGE D5:http://www.hikanpou.com/product/SPANISCHE-FLIEGED5.html
    御秀堂:http://www.hikanpou.com/product/御秀堂養顔痩身.html
    韓国痩身一号:http://www.hikanpou.com/product/韓国痩身一号.html
    痩身1号:http://www.hikanpou.com/product/韓国痩身一号.html
    曲美:http://www.hikanpou.com/product/xinqumei.html
    大印象:http://www.hikanpou.com/product/dayinxiang.html
    碧生源:http://www.hikanpou.com/product/bishengyuan.html
    V26:http://www.hikanpou.com/product/V26.html
    避妊薬:http://www.hikanpou.com/pills/避妊中絶.html
    中絶薬:http://www.hikanpou.com/pills/避妊中絶.html
    精力剤:http://www.hikanpou.com/seiryokuzai/精力剤.html
    レディーチャイナ:http://www.hikanpou.com/product/蒼蝿水5.html
    ed治療薬:http://www.hikanpou.com/seiryokuzai/ED治療.html

    ReplyDelete
  14. シアリス:http://www.cialismall.com
    Cialis:http://www.cialismall.com
    レビトラ:http://www.levitramall.com
    levitra:http://www.levitramall.com
    精力剤:http://www.hikanpou.com
    精力剤:http://www.hakanpo.com
    威哥王:http://威哥王.kanpocom.com
    威哥王:http://xn--kwrt2jp9z.kanpocom.com
    巨人倍増:http://巨人倍増.hikanpou.com
    巨人倍増:http://xn--gmq15an1qquf.hikanpou.com
    紅蜘蛛:http://紅蜘蛛.hakanpo.com
    紅蜘蛛:http://xn--19zl5rhf.hakanpo.com

    シアリス:http://www.cialismall.com
    Cialis:http://www.cialismall.com
    レビトラ:http://www.levitramall.com
    levitra:http://www.levitramall.com
    精力剤:http://www.hikanpou.com
    精力剤:http://www.hakanpo.com
    威哥王:http://威哥王.kanpocom.com
    威哥王:http://xn--kwrt2jp9z.kanpocom.com
    巨人倍増:http://巨人倍増.hikanpou.com
    巨人倍増:http://xn--gmq15an1qquf.hikanpou.com
    紅蜘蛛:http://紅蜘蛛.hakanpo.com
    紅蜘蛛:http://xn--19zl5rhf.hakanpo.com

    シアリス:http://www.cialismall.com
    Cialis:http://www.cialismall.com
    レビトラ:http://www.levitramall.com
    levitra:http://www.levitramall.com
    精力剤:http://www.hikanpou.com
    精力剤:http://www.hakanpo.com
    威哥王:http://威哥王.kanpocom.com
    威哥王:http://xn--kwrt2jp9z.kanpocom.com
    巨人倍増:http://巨人倍増.hikanpou.com
    巨人倍増:http://xn--gmq15an1qquf.hikanpou.com
    紅蜘蛛:http://紅蜘蛛.hakanpo.com
    紅蜘蛛:http://xn--19zl5rhf.hakanpo.com

    シアリス:http://www.cialismall.com
    Cialis:http://www.cialismall.com
    レビトラ:http://www.levitramall.com
    levitra:http://www.levitramall.com
    精力剤:http://www.hikanpou.com
    精力剤:http://www.hakanpo.com
    威哥王:http://威哥王.kanpocom.com
    威哥王:http://xn--kwrt2jp9z.kanpocom.com
    巨人倍増:http://巨人倍増.hikanpou.com
    巨人倍増:http://xn--gmq15an1qquf.hikanpou.com
    紅蜘蛛:http://紅蜘蛛.hakanpo.com
    紅蜘蛛:http://xn--19zl5rhf.hakanpo.com

    シアリス:http://www.cialismall.com
    Cialis:http://www.cialismall.com
    レビトラ:http://www.levitramall.com
    levitra:http://www.levitramall.com
    精力剤:http://www.hikanpou.com
    精力剤:http://www.hakanpo.com
    威哥王:http://威哥王.kanpocom.com
    威哥王:http://xn--kwrt2jp9z.kanpocom.com
    巨人倍増:http://巨人倍増.hikanpou.com
    巨人倍増:http://xn--gmq15an1qquf.hikanpou.com
    紅蜘蛛:http://紅蜘蛛.hakanpo.com
    紅蜘蛛:http://xn--19zl5rhf.hakanpo.com

    シアリス:http://www.cialismall.com
    Cialis:http://www.cialismall.com
    レビトラ:http://www.levitramall.com
    levitra:http://www.levitramall.com
    精力剤:http://www.hikanpou.com
    精力剤:http://www.hakanpo.com
    威哥王:http://威哥王.kanpocom.com
    威哥王:http://xn--kwrt2jp9z.kanpocom.com
    巨人倍増:http://巨人倍増.hikanpou.com
    巨人倍増:http://xn--gmq15an1qquf.hikanpou.com
    紅蜘蛛:http://紅蜘蛛.hakanpo.com
    紅蜘蛛:http://xn--19zl5rhf.hakanpo.com

    シアリス:http://www.cialismall.com
    Cialis:http://www.cialismall.com
    レビトラ:http://www.levitramall.com
    levitra:http://www.levitramall.com
    精力剤:http://www.hikanpou.com
    精力剤:http://www.hakanpo.com
    威哥王:http://威哥王.kanpocom.com
    威哥王:http://xn--kwrt2jp9z.kanpocom.com
    巨人倍増:http://巨人倍増.hikanpou.com
    巨人倍増:http://xn--gmq15an1qquf.hikanpou.com
    紅蜘蛛:http://紅蜘蛛.hakanpo.com
    紅蜘蛛:http://xn--19zl5rhf.hakanpo.com

    ReplyDelete
  15. VigRx:http://www.hikanpou.com/product/VigRx.html
    D10催情剤:http://www.hikanpou.com/product/D10.html
    花痴:http://www.hikanpou.com/product/花痴.html
    威哥王:http://www.hikanpou.com/product/威哥王.html
    巨人倍増:http://www.hikanpou.com/product/巨人倍増.html
    淫インモラル:http://www.hikanpou.com/product/immoral.html
    インモラル:http://www.hikanpou.com/product/immoral.html
    妖姫:http://www.hikanpou.com/product/youhi.html
    RU486:http://www.hikanpou.com/product/RU486.html
    紅蜘蛛:http://www.hikanpou.com/product/紅蜘蛛.html
    D10:http://www.hikanpou.com/product/D10.html
    D10媚薬:http://www.hikanpou.com/product/D10.html
    三鞭粒:http://www.hikanpou.com/product/weige.html
    絶對高潮:http://www.hikanpou.com/product/絶對高潮.html
    FLY D5:http://www.hikanpou.com/product/蒼蝿水.html
    D5原液:http://www.hikanpou.com/product/蒼蝿水.html
    蒼蝿水:http://www.hikanpou.com/product/魔力蒼蝿水5.html
    三便宝:http://www.hikanpou.com/product/三便宝.html
    蟻力神:http://www.hikanpou.com/product/蟻力神1.html
    三體牛鞭:http://www.hikanpou.com/product/三体牛鞭.html
    三体牛鞭:http://www.hikanpou.com/product/三体牛鞭.html
    勃動力三體牛鞭:http://www.hikanpou.com/product/三体牛鞭.html
    狼1号:http://www.hikanpou.com/product/狼1号.html
    狼一号:http://www.hikanpou.com/product/狼1号.html
    五便宝:http://www.hikanpou.com/product/五便宝.html
    男宝:http://www.hikanpou.com/product/男宝5箱.html
    蔵八宝:http://www.hikanpou.com/product/蔵八宝.html
    新一粒神:http://www.hikanpou.com/product/新一粒神.html
    リドスプレー:http://www.hikanpou.com/product/LIDOSPRAY.html
    ビグレックス:http://www.hikanpou.com/product/VigRx.html
    vigrxプラス:http://www.hikanpou.com/product/VigRx.html
    Wenickman:http://www.hikanpou.com/product/Wenickman.html
    MaxMan:http://www.hikanpou.com/product/MaxMan.html
    情愛芳香劑:http://www.hikanpou.com/product/rush724.html
    壮天根:http://www.hikanpou.com/product/壮天根.html
    魔根:http://www.hikanpou.com/product/魔根金中草.html
    夜夜堅:http://www.hikanpou.com/product/夜夜堅.html
    壮陽一号:http://www.hikanpou.com/product/壮陽一号.html
    マカ:http://www.hikanpou.com/product/MACA.html
    黒倍王:http://www.hikanpou.com/product/黒倍王.html
    花之欲:http://www.hikanpou.com/product/花之欲.html
    美人豹:http://www.hikanpou.com/product/美人豹5.html
    妻之友:http://www.hikanpou.com/product/妻之友.html
    福源春:http://www.hikanpou.com/product/福源春.html
    蟻王:http://www.hikanpou.com/product/アリ王蟻王,ANTKING.html
    アリ王:http://www.hikanpou.com/product/アリ王蟻王,ANTKING.html
    SEX DROPS:http://www.hikanpou.com/product/SEXDROPS5.html
    片仔廣:http://www.hikanpou.com/product/片仔廣.html
    へんしこう:http://www.hikanpou.com/product/片仔廣.html
    維尼好:http://www.hikanpou.com/product/維尼好消毒液.html
    縮陰膏:http://www.hikanpou.com/product/縮陰膏.html
    牛黄清心丸:http://www.hikanpou.com/product/牛黄清心丸.html
    同仁堂牛黄清心丸:http://www.hikanpou.com/product/牛黄清心丸2.html
    消渇丸:http://www.hikanpou.com/product/消渇丸.html
    999皮炎平:http://www.hikanpou.com/product//999皮炎平.html
    同仁烏鶏白鳳丸:http://www.hikanpou.com/product/烏鶏白鳳丸.html
    婦科千金片:http://www.hikanpou.com/product/婦科千金片.html
    セフラジン:http://www.hikanpou.com/product/cefradine.html
    終極痩身:http://www.hikanpou.com/product/zhongjishoushen.html
    天天素:http://www.hikanpou.com/product/天天素.html
    スーパーファット:http://www.hikanpou.com/product/スーパーファットNEWSUPERFATBURNIN.html
    SPANISCHE FLIEGE D5:http://www.hikanpou.com/product/SPANISCHE-FLIEGED5.html
    御秀堂:http://www.hikanpou.com/product/御秀堂養顔痩身.html
    韓国痩身一号:http://www.hikanpou.com/product/韓国痩身一号.html
    痩身1号:http://www.hikanpou.com/product/韓国痩身一号.html
    曲美:http://www.hikanpou.com/product/xinqumei.html
    大印象:http://www.hikanpou.com/product/dayinxiang.html
    碧生源:http://www.hikanpou.com/product/bishengyuan.html
    V26:http://www.hikanpou.com/product/V26.html
    避妊薬:http://www.hikanpou.com/pills/避妊中絶.html
    中絶薬:http://www.hikanpou.com/pills/避妊中絶.html
    精力剤:http://www.hikanpou.com/seiryokuzai/精力剤.html
    レディーチャイナ:http://www.hikanpou.com/product/蒼蝿水5.html
    ed治療薬:http://www.hikanpou.com/seiryokuzai/ED治療.html

    ReplyDelete