1

I am analyzing a malware at the moment which scans for a lot of filenames and ClassNames to recognize if it is under supervision or not.

My problem is, that all the filenames and ClassNames are stored as Hashes. Therefore i did some kind of dictionary attack (with a list of tools I know). It was very effective - but out of 20 hashes, i am still missing one!

I am searching for days now... it drives me crazy :D

As you can see, there are some tools missing in my list - can you complete it? Please think of your most favourite tools and take a look at the list - are they already in there? :)

Thank you very much in advance!

In case you need a list like this one day, feel free to use it.

|improve this question
  • If your current tools worked for 95%, chances are that that word is just not in your dictionary. – usr2564301 Feb 13 '18 at 18:32
  • 1
    I added every tool to the list I ever used, then i looked up the ClassName of each and hashed it using the Algorithm above. Finally I compared the hashes to the list of hashes i extracted from the malware. Therefore yes, this last tool it is not in the list - that's exactly the problem since I do not know any more RE tools for Windows. – flood Feb 13 '18 at 19:02
1

I would try a Z3 solver if simple bruteforcing fails. The hashing function doesn't seem that hard at the first glance. Of course there aren't any pre-made tools (I think) and a minimal use of your gray matter is required.

https://www.google.com.au/search?q=z3+solver+hash

|improve this answer
  • You can find a lot of material about using Z3 for reverse-engineering here: Yurichev's Blog. Quite interesting tool, indeed. – perror Feb 14 '18 at 8:41
  • 2
    Vitaly, the problem is that Z3 might find whatever that creates that hash. I really doubt that the hash is cryptographically safe, thus, there will be a gazillion or more collisions. – joxeankoret Feb 14 '18 at 9:06
  • 1
    thanks! but yes, i had around 3000 collisions per hash within the first 12 hours of brute-forcing. anyway, thank you for the hint! – flood Feb 14 '18 at 15:07
  • 1
    @joxeankoret I do not see a problem in collisions - find your gazillion and filter out the only (hopefully) valid one via some simple tool that checks for valid names. Extremely easy in Windows with blah.exe/dll/… name structure, and in Unices just look for alphanumeric space. This is a basic approach in "cryptanalysis". OP if you already have your collisions, then you're already half done, not need for Z3. – Vitaly Osipov Feb 23 '18 at 8:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.