I'm a newbie to malware analysis and reverse engineering in general. I got hold of a Dyre
malware sample from theZoo
on GitHub and I've been trying to analyze it.
I've put up my analysis report here. I looked up Symantec's report on the same malware family here. They've some additional information on the remote IP addresses that the malware connects to.
When conducting dynamic analysis, I could see on Wireshark that the malware is trying to get the resource: /cho1017/W512600.52818BB853DEE114E367C21952160412/5/pub...
. My VM was not connected to the Internet, so I don't know what that resource actually is. I'm not sure if that can be simulated with INetSim
.
Can static analysis help to identify the IP addresses mentioned in Symantec's report? I've been trying static analysis but I'm lost. Although I know what static analysis entails, I'm having a hard time understanding how to proceed from the start
area of the code and look for network related code.
If any one has experience with this malware family, any help would be appreciated. Also, if possible I'd like to know the quality of the analysis report that I've put up. I'd like to make sure that I'm writing malware analysis reports the right way.