> For the complete documentation index, see [llms.txt](https://chinnidiwakar.gitbook.io/githubimport/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://chinnidiwakar.gitbook.io/githubimport/forensics/basic-forensic-methodology/malware-analysis.md).

# Malware Analysis

## Forensics CheatSheets

<https://www.jaiminton.com/cheatsheet/DFIR/#>

## Online Services

* [VirusTotal](https://www.virustotal.com/gui/home/upload)
* [HybridAnalysis](https://www.hybrid-analysis.com)
* [Koodous](https://koodous.com/)
* [Intezer](https://analyze.intezer.com/)

## Offline antivirus

### Yara

#### Install

```bash
sudo apt-get install -y yara
```

#### Prepare rules

Use this script to download and merge all the yara malware rules from github: <https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9>\
Create the ***rules*** directory and execute it. This will create a file called ***malware\_rules.yar*** which contains all the yara rules for malware.

```bash
wget https://gist.githubusercontent.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9/raw/4ec711d37f1b428b63bed1f786b26a0654aa2f31/malware_yara_rules.py
mkdir rules
python malware_yara_rules.py
```

#### Scan

```bash
yara -w malware_rules.yar image  #Scan 1 file
yara -w malware_rules.yar folder #Scan hole fodler
```

### ClamAV

#### Install

```
sudo apt-get install -y clamav
```

#### Scan

```bash
sudo freshclam      #Update rules
clamscan filepath   #Scan 1 file
clamscan folderpath #Scan the hole folder
```

### rkhunter

Tools like [**rkhunter**](http://rkhunter.sourceforge.net/) can be used to check the filesystem for possible **rootkits** and malware.

```bash
sudo ./rkhunter --check -r / -l /tmp/rkhunter.log [--report-warnings-only] [--skip-keypress]
```

### PEpper

[PEpper ](https://github.com/Th3Hurrican3/PEpper)checks some basic stuff inside the executable (binary data, entropy, URLs and IPs, some yara rules).