Expert 1: Malware Reverse Engineering - Binary Analysis & Disassembly

cd ~ && mkdir forensics-exp1 && cd forensics-exp1

# 1. Buat binary sample sederhana
python3 << 'PYEOF'
import struct

# Buat ELF binary minimal yang mensimulasikan malware
# (Linux executable - educational sample)

code = b'\x90' * 16  # NOP sled

# Bagian .text
text = b''
# Fungsi: connect to C2
text += b'\x48\xc7\xc0\x29\x00\x00\x00'  # mov rax, 41 (socket syscall)
text += b'\x48\xc7\xc7\x02\x00\x00\x00'  # mov rdi, 2 (AF_INET)
text += b'\x48\xc7\xc6\x01\x00\x00\x00'  # mov rsi, 1 (SOCK_STREAM)  
text += b'\x0f\x05'                       # syscall (socket())
text += b'\x90' * 8

# connect() syscall
text += b'\x48\xc7\xc0\x2a\x00\x00\x00'  # mov rax, 42 (connect)
text += b'\x90' * 20
text += b'\x0f\x05'

# write() - send data exfil
text += b'\x48\xc7\xc0\x01\x00\x00\x00'  # mov rax, 1 (write)
text += b'\x90' * 16
text += b'\x0f\x05'

# read() - receive command
text += b'\x48\xc7\xc0\x00\x00\x00\x00'  # mov rax, 0 (read)
text += b'\x0f\x05'
text += b'\xeb\xe6'  # jmp loop (infinite loop - C2 polling)

# Hidden strings (di .rodata)
strings = b'malware-c2.com\x00'
strings += b'203.0.113.5\x00'
strings += b'/etc/shadow\x00'
strings += b'S3cur3P@ss\x00'

# Build ELF header sederhana
elf = b'\x7fELF\x02\x01\x01\x00'  # ELF magic
elf += b'\x00' * 8
elf += struct.pack('<HHI', 2, 0x3E, 1)  # Exec type, x86-64, version
elf += struct.pack('<QQ', 0x400000, 0x78)  # Entry, PH offset
elf += b'\x00' * 40

with open('sample-malware.elf', 'wb') as f:
    f.write(elf + text + strings)

print("✅ sample-malware.elf - ELF64 binary simulation")
PYEOF

# 2. File identification
echo "=== File Type ==*"
file sample-malware.elf

# 3. Strings extraction
echo ""
echo "=== Strings - C2 & Credentials ==*"
strings sample-malware.elf | grep -E "(\.com|\.local|password|shadow|http)"

# 4. Disassembly (objdump)
echo ""
echo "=== Disassembly - syscall Analysis ==*"
objdump -d sample-malware.elf 2>/dev/null || python3 << 'PYEOF'
print("Disassembly (simulated):")
print(f"{'Address':<20} {'Instruction':<30} {'Meaning'}")
print("-"*70)
print(f"{'0x400078':<20} {'mov rax, 0x29 (41)':<30} {'syscall = socket()'}")
print(f"{'0x40007f':<20} {'mov rdi, 0x2':<30} {'AF_INET'}")
print(f"{'0x400086':<20} {'mov rsi, 0x1':<30} {'SOCK_STREAM'}")
print(f"{'0x40008d':<20} {'syscall':<30} {'→ socket created'}")
print(f"{'0x40009a':<20} {'mov rax, 0x2a (42)':<30} {'syscall = connect()'}")
print(f"{'0x4000b0':<20} {'syscall':<30} {'→ connect to C2'}")
print(f"{'0x4000b5':<20} {'mov rax, 0x1 (1)':<30} {'syscall = write()'}")
print(f"{'0x4000c8':<20} {'syscall':<30} {'→ send data (exfil!)'}")
print(f"{'0x4000cd':<20} {'mov rax, 0x0 (0)':<30} {'syscall = read()'}")
print(f"{'0x4000d4':<20} {'syscall':<30} {'→ receive command'}")
print(f"{'0x4000d6':<20} {'jmp loop':<30} {'→ infinite polling'}")
PYEOF

# 5. Analisis - buat laporan
echo ""
echo "=== Laporan Reversing ==*"
echo "Binary: sample-malware.elf (ELF64 x86-64)"
echo "Function: Backdoor / RAT (Remote Access Trojan)"
echo ""
echo "Flow:"
echo "  [1] socket(AF_INET, SOCK_STREAM) → buat koneksi TCP"
echo "  [2] connect(203.0.113.5:80) → konek ke C2 server"  
echo "  [3] write() → kirim data sistem (/etc/shadow)"
echo "  [4] read() → terima perintah dari C2"
echo "  [5] Infinite loop → polling terus menerus"
echo ""
echo "IOCs:"
echo "  C2: 203.0.113.5"
echo "  Domain: malware-c2.com"
echo "  Target: /etc/shadow (password hash theft)"
echo "  Found Credential: S3cur3P@ss"