Umhlahlandlela ophelele wokuhlaziywa kwe-malware ukuvikela izinhlelo zakho

Informatec Digital » Izinsiza » Umhlahlandlela ophelele wokuhlaziywa kwe-malware ukuvikela izinhlelo zakho

Ukuhlaziywa kwe-malware sekungomunye wemisebenzi ebaluleke kakhulu ekuphepheni kwe-inthanethi kwanamuhla , kokubili kumabhizinisi nakubasebenzisi basekhaya. Nsuku zonke, kuvela izinhlobo ezintsha zekhodi enonya ezingabhala amafayela, zintshontshe iziqinisekiso, noma zihlole konke esikwenzayo kumadivayisi ethu, ngakho ukuqonda ukuthi ungayifunda futhi uyithole kanjani le software eyingozi akuseyona indawo ekhethekile yamalabhorethri akhethekile.

Kunokuba umsebenzi "wobungcweti" nje kuphela, ucwaningo oluhlelekile lwe-malware yilona oluvumela impendulo esheshayo yezehlakalo, ukukhiqizwa kwezignali zokutholwa, isofthiwe ethuthukisiwe ye-antivirus, kanye nokuthuthukiswa kwamapulatifomu okuvikela amabhizinisi. Ake sibheke kabanzi ukuthi kuyini ukuhlaziywa kwe-malware, izinhlobo ezahlukene ze-malware, ukuthi isetshenziswa kanjani ekuphepheni kwansuku zonke, yiziphi izimpawu ezibonisa ukutheleleka okungenzeka, kanye namathuluzi namasu asetshenziswa abahlaziyi abangochwepheshe.

Kuyini ukuhlaziywa kwe-malware futhi kungani kubaluleke kangaka?

Uma sikhuluma ngokuhlaziywa kwe-malware, sisho ukuhlola uhlelo oluyingozi (noma okusolwa ukuthi luyingozi) ngokujulile ukuze siqonde ukuthi lwenzani, ukuthi lulwenza kanjani, nokuthi lungaba namuphi umthelela ohlelweni noma kunethiwekhi. Lokhu kuhlolwa kungaba ngesandla, kusetshenziswa ubuchwepheshe bokubuyisela emuva kanye nokulungisa amaphutha, noma kungasebenzisa amapulatifomu ezenzakalelayo kanye nama-sandbox ahlukanisa futhi abike ngosongo.

Ngenxa yale nqubo, amaqembu ezokuphepha angahlukanisa izehlakalo ngokwezinga lobucayi , akhiphe izinkomba zokuyekethisa (IoC), athuthukise ukutholakala kusenesikhathi, alungise imithetho yezixazululo zawo zokuphepha, futhi aqonde ukuthi umkhankaso wokuhlasela uyisigameko esizimele noma ingxenye yosongo olubanzi noluhlelekile.

Ukuhlaziywa kwe-malware kuvumela nokutholakala kwesofthiwe eyingozi ngaphambi kokuba ibangele umonakalo , into ebalulekile ezindaweni zezinkampani lapho ukutheleleka okukodwa kwe-ransomware kungakhubaza yonke imisebenzi yenhlangano noma kudalule idatha ebucayi yamakhasimende kanye neyabasebenzi.

Izinhlobo ze-malware kanye nezimpawu zokutheleleka

Igama elithi “malware” liyigama elihlanganisa zonke izinhlobo zezinhlelo ezenzelwe ukubangela umonakalo noma ukwenza okuphambene nezintshisekelo zomsebenzisi noma zenkampani. Akuwona wonke ama-malware aziphatha ngendlela efanayo, futhi awaphishekeli umgomo ofanayo, kodwa abelana ngesimo esiyimfihlo nesiyingozi.

Phakathi kwezinhlobo ezivame kakhulu ze-malware, sithola uhlu olude lwezinhlobo, ngayinye inobuntu bayo:

• Amagciwane: ikhodi eziphindaphindayo ngosizo lomsebenzisi, ngokuvamile ngokuvula amafayela anegciwane noma ngokusebenzisa izinhlelo ezinegciwane.
• Izikelemu: Zisakazeka ngokuzenzakalelayo ngokusebenzisa ubuthakathaka benethiwekhi, ngaphandle kwesidingo sokungenelela komsebenzisi.
• I-Trojans: Bazenza sengathi isofthiwe esemthethweni noma engenangozi ukuze bangene ohlelweni ngokunyenya ngaphandle kokuphakamisa izinsolo.
• I-RAT (iThrojani yokufinyelela kude): Ihhashi leTrojan lenzelwe ukunika umhlaseli ukulawula okugcwele kude ikhompyutha.
• umnyango ongemuva: umnyango wangemuva ovumela umhlaseli ukuthi akhiphe imiyalo noma afinyelele uhlelo ngaphandle kokuqinisekiswa okuvamile.
• Umlandi noma i-dropper: uhlelo oluncane olunomsebenzi oyinhloko ukulanda nokusebenzisa enye i-malware eyinkimbinkimbi kakhulu.
• I-Hacktool: amathuluzi asetshenziselwa ukuhlasela (izikena, amandla amakhulu, njll.), okungahlali kunonya ngokuphelele.
• I-Rhlengware: Ibhala amafayela esisulu ngemfihlo futhi ifuna inkokhelo ukuze kuthiwe iwathole.
• I-Bot: ingxenye evumela ithimba ukuthi lihlanganiswe ne-botnet ukuze liqalise ukuhlaselwa okuhleliwe.
• I-Rootkit: Isofthiwe eklanyelwe ukuzifihla nokugcina ukufinyelela okuqhubekayo ngamalungelo aphezulu.
• I-Keylogger: Iqopha ukuchofoza okhiye ukuze yebe amaphasiwedi, imiyalezo, kanye nolunye ulwazi olubucayi.
• Isofthiwe yokumba: Isebenzisa izinsiza zeqembu ukumba ama-cryptocurrencies ngaphandle kwemvume.
• Ulwazi Lokweba: Igxile ekwebeni iziqinisekiso, ulwazi lomuntu siqu, noma idatha yezezimali.
• I-spyware: Iqapha umsebenzi womsebenzisi futhi ithumela ulwazi kumhlaseli ngaphandle kwemvume.
• I-PUP/PUA: izinhlelo ezingase zingafuneki, njenge-browser toolbar kanye ne-adware enolaka.
• I-Adware: Ibonisa ukukhangisa okuphazamisayo futhi ingashintsha isiphequluli noma uhlelo.

Zonke lezi zinhlobo ze-malware zingathinta noma yiluphi uhlelo lokusebenza lwesimanje : i-Windows, i-Linux, i-macOS, i-Android, i-iOS, nezinye. Ukushintsha amapulatifomu akuqinisekisi ukuphepha; kushintsha kuphela izinhlobo zezinsongo ozohlangana nazo.

Izimpawu zokutheleleka zingahluka kakhulu, kodwa amanye amaphethini avamile. Ikhompyutha etheleleke nge-malware ivame ukwehla ijubane ngokuphawulekayo , ifeni iyaphenduka ngokungazelelwe, impilo yebhethri incishiswa kakhulu, kanye namafasitela avelelayo, amathuluzi esiphequluli ongakhumbuli ukuwafaka, noma kuvela imiyalezo yamaphutha angajwayelekile kanye nezikrini.

Ezinye izinkinga ezivamile zifaka phakathi ukuntuleka kwesikhala sediski ngokuzumayo , amafayela ashintsha izandiso, ifayela le-README eliyimfihlakalo elisho ukuthi konke kubethelwe (isu elivamile le-ransomware), noma ukusetshenziswa kwedatha okungavamile kumadivayisi eselula. Ngokuvamile, lezi zimpawu zibonisa izinqubo ezifihliwe ezisebenzisa izinsiza ngemuva.

Indlela i-malware engena ngayo kumadivayisi ethu

Indawo evame kakhulu yokungena kwi-malware yi -phishing emails . Umhlaseli uzenza ibhange, inkampani yeposi, isevisi yesevisi, noma ngisho nomuntu esimaziyo, futhi uzama ukusikhohlisela ekuchofozeni isixhumanisi noma ekuvuleni okunamathiselwe okuqukethe ikhodi enonya.

Enye indlela evame kakhulu ukulanda isofthiwe kumawebhusayithi angekho emthethweni noma ezitolo zezinhlelo zokusebenza zenkampani yangaphandle. Izinhlelo "zamahhala" ezinezimfa, ama-generator amalayisense, noma ama-activator akhokhelwayo zivame ukuza zihlanganiswe ne-malware efihliwe, futhi abasebenzisi bavame ukwamukela ukufakwa kwazo cishe ngaphandle kokuqaphela.

Ngaphezu kwalokho, kunemindeni ye-malware ekwazi ukusebenzisa kabi ubuthakathaka benethiwekhi ngaphandle kokungenelela komsebenzisi, njengoba kwakunjalo nge-WannaCry, i-Conficker, i-Blaster, i-Slammer, ne-Sasser. Kulezi zimo, i-worm idinga kuphela ukuxhunywa kunethiwekhi esengozini ukuze isakazeke.

Isixazululo esithile sokutheleleka sizoncika ohlotsheni lwe-malware kanye nomonakalo odalwe, kodwa ezimweni ezifana ne-ransomware, into enganconywa kakhulu ukukhokha isihlengo , ngoba sondla ibhizinisi elingekho emthethweni futhi asiqinisekisi ukutholwa kwedatha.

Nini futhi kungani kufanele uqalise ukuskena kwe-malware

Ungaskena i-malware cishe noma nini lapho ufuna ukuhlola isimo sekhompyutha yakho , kodwa kunezikhathi lapho kunconywa khona kakhulu. Uma usola ukuthi idivayisi yakho ingase itheleleke, noma uma ufuna ukuqinisekisa ukuthi ukutheleleka kwangaphambilini kususiwe ngokuphelele, kunengqondo ukwenza iskena ngokushesha.

Izimpawu ezidinga uphenyo olwengeziwe zifaka phakathi ukwehla okukhulu kokusebenza , impilo yebhethri ephansi ngokumangazayo, ukusetshenziswa kwedatha okuphezulu okungachazeki, noma yikuphi ukuziphatha okungavamile ezinhlelweni zokusebenza kanye nohlelo. Zonke lezi zimpawu zikhomba izinqubo ezingaziwa ezidla izinsiza buthule.

Amathuluzi ahlanganisiwe njengeMicrosoft Defender akuvumela ukuthi usebenzise ukuskena okusheshayo noma okuphelele. Uma ukuskena sekuqediwe, uhlelo ngokwalo lukhombisa ukuthi kukhona yini okusolisayo okutholiwe, futhi ezimweni eziningi lunikeza izinketho ezizenzakalelayo zokuvalela noma ukususa usongo olutholiwe.

Izinhlobo nezigaba zokuhlaziywa kwe-malware

Abahlaziyi basebenzisa izindlela ezahlukene ukuze baqonde ukuthi usongo lusebenza kanjani. Umehluko ojwayelekile uphakathi kokuhlaziywa okungaguquki, ukuhlaziywa okuguquguqukayo, kanye nokuhlaziywa okuxubile , kodwa empeleni, inqubo ivame ukuhlelwa ngezigaba eziningana eziba nzima kakhulu njengoba uphenyo luqhubeka.

Esigabeni sokuqala , ukuhlaziywa kokuskena okuzenzakalelayo kuvame ukusetshenziswa . Amapulatifomu afana ne-VirusTotal noma ama-sandbox ezinkampani aqhathanisa isampula nama-database ezinsongo ezaziwayo, asebenzise ifayela ezindaweni ezilawulwayo, futhi akhiqize imibiko enethrafikhi yenethiwekhi, umsebenzi wefayela, izinguquko zokubhalisa, kanye nezinye izindlela zokuziphatha ezibalulekile.

Okulandelayo kuza ukuhlaziywa kwezakhiwo ezimile , lapho ifayela lihlolwa ngaphandle kokwenziwa: ama-hashe, izintambo ezifakiwe, izinsiza, imethadatha, izihloko ze-PE, namanye amafomethi afanayo. Amathuluzi afana ne-PeStudio, i-PE-bear, noma i-pefile akuvumela ukuthi ubone ngeso lengqondo isakhiwo sangaphakathi futhi uthole amasiginesha afihliwe, ama-URL, noma amakheli e-IP.

Ukuhlaziywa okunamandla kuhilela ukusebenzisa i-malware endaweni ehlukanisiwe (imishini ebonakalayo ye-Windows, ukusatshalaliswa njenge-REMnux, njll.) nokubuka ngesikhathi sangempela izinqubo ezidalwe, ukuguqulwa kwesistimu yamafayela, okhiye bokubhalisa, ukuxhumana kwenethiwekhi, izinsizakalo, noma ama-mutexe akhiqizwe. Yilapho iziqaphi ezithuthukisiwe njenge-Process Monitor noma amathuluzi okubamba inethiwekhi njenge-Wireshark eqala khona ukusebenza.

Ekugcineni, esigabeni esijulile kakhulu, ochwepheshe baguqula ikhodi besebenzisa ama-disassemblers nama-decompilers (IDA, Ghidra, Radare, DnSpy, Jadx, njll.). Besebenzisa ama-debuggers afana ne-x64dbg noma i-WinDbg, badlula ekusebenzeni, bahlaziye izingcingo ze-API, bahlukanise ukucushwa kwangaphakathi, futhi bathole ukubethela okubucayi, ukukhishwa, noma izindlela zokugwema.

Amacala okusetshenziswa kokuhlaziywa kwe-malware

Umgomo oyinhloko walo msebenzi wonke ukuthola ubuhlakani obusebenzayo mayelana nosongo , into esebenza ezicini eziningi zokuphepha kwe-inthanethi kwansuku zonke. Akukhona nje "ukubheka" ukuthi i-malware ihlelwa kanjani, kodwa futhi nokuthuthukisa ukuzivikela kwenhlangano iyonke.

Esinye isimo esivamile impendulo yesehlakalo . Uma kutholwa ukuziphatha okusolisayo noma ukungena, ithimba lempendulo lidinga ukwazi ukuthi hlobo luni lwe-malware oluyimbangela yalo, yiziphi izenzo elizenzayo, yiziphi izinhlelo elizifakile engozini, nokuthi lingaziqeda kanjani ngaphandle kokushiya umkhondo. Ukuhlaziya kubavumela ukuthi bachaze ububanzi besehlakalo kanye nohlelo lokululama.

Iphinde isetshenziswe kakhulu ocwaningweni nasekutholeni i-malware kokubili emazingeni ezemfundo kanye nawezimboni. Amalabhorethri ezinkampani zokuphepha kanye namaqembu ocwaningo ahlola imindeni ethile ye-malware (isb., i-TrickBot, i-FIN7, nabanye) ukuze ahlukanise uchungechunge lwawo oluphelele lokuhlasela, aqonde ukuvela kwawo, futhi aklame izindlela zokuzivikela ezingcono.

Ukusetshenziswa kwesithathu okuyisihluthulelo ukukhipha izinkomba zokuvumelana (ama-IoC) . Kusampula ngayinye, kukhishwa ama-hashe amafayela, amakheli e-IP, izizinda, izindlela zokubhalisa, amagama ezinqubo, noma amaphethini ezintambo, okungabe sekusetshenziselwa ukuthola okuzenzakalelayo ku-SIEM, EDR, nakwamanye amapulatifomu.

Ukuhlaziywa kuthuthukisa nokuzingela okusongelayo . Ngokuqonda kahle ukuthi uhlobo oluthile luziphatha kanjani, abazingeli bangalandelela imikhondo ecashile ngaphakathi kwezinhlelo zenhlangano ukuze bathole izifo ezingakatholakali ngaphambilini noma ukunyakaza okuthule eceleni.

Okokugcina, lonke lolu lwazi luthuthukisa izexwayiso kanye nokuhlukaniswa kwezinsongo , okusiza ekubekeni phambili ukuthi yiziphi izehlakalo ezidinga ukunakwa okusheshayo nokuthi yiziphi ezingaphathwa ngokuthula. Ukuphepha kwe-endpoint yesimanje kanye nezixazululo ze-XDR zifaka lolu lwazi ukuze kufakwe umongo walokho okwenzekayo ngesikhathi sangempela.

Izinzuzo zamasu okuhlaziya i-malware

Phakathi kwezinzuzo ezicacile kakhulu ukukhiqizwa kobuhlakani bezingozi obunenani eliphezulu . Isampula ngayinye ehlaziyiwe inikeza ama-IoC amasha nama-TTP (amasu, amaqhinga, nezinqubo) ahlanganiswe nezinjini zokuthola, imithetho ye-Yara, uhlu lwabantu abamnyama, kanye nezinhlelo zodumo.

Ngaphezu kwalokho, ukuhlaziya okujulile kuthuthukisa ukuqonda okusebenzayo kwe-malware : inhloso yayo, izindlela zayo zokuqhubeka, ubuthakathaka obusebenzisayo, kanye namasu ayo okugwema. Lokhu kuvumela ukuthuthukiswa kwama-patches, ukuqinisa ukucushwa, kanye nokwakhiwa kwezilawuli ezithile ukuvimba ukusebenza kwayo.

Akufanele sikhohlwe isici sokuhlaziya ubungozi bezinsuku ezingenalutho . Uma isampula isebenzisa iphutha elingaziwa, ukutadisha ngokucophelela lokhu kuxhashazwa kusiza ekuboneni ubuthakathaka obuyisisekelo nokuthuthukisa izibuyekezo zokuphepha eziqinile noma izindlela zokunciphisa.

Okokugcina, ukuhlaziywa kwe-malware kuyithuluzi elihle kakhulu lokufunda nokuthuthukisa amakhono ochwepheshe bezokuphepha kwe-inthanethi. Ukuqaphela ukuthi izinsongo zangempela zisebenza kanjani kuyindlela engcono kakhulu yokuqonda ukuthi yini esebenza ngempela ezweni lokuzivikela nokuthi yini engasebenzi.

Ukudalwa nokuvikelwa kwendawo yokuhlaziya

Ngaphambi kokushesha ukusebenzisa amasampula njengokungathi akukho kusasa, kubalulekile ukwakha ilabhorethri elawulwayo . Indlela evamile ukusetha imishini ebonakalayo ye-Windows 10 kanye nokusabalalisa okukhethekile njenge- REMnux Linux , okuxhunywe komunye nomunye kunethiwekhi yangasese ehlukanisiwe nezinye izingqalasizinda.

Amathuluzi athile afana nama-analytics suite (isibonelo, amaqoqo ezinsizakusebenza ezifana ne-RevCore Tools, i-Sysinternals, ama-disassemblers, kanye nama-debugger) afakiwe kule mishini . Ngaphezu kwalokho, ukubanjwa kwethrafikhi kulungiselelwe ukurekhoda konke isampula ezama ukukuthumela noma ukukwamukela ngenethiwekhi.

Kubalulekile ukukhumbula ukuthi i-malware eningi ithola ukuthi isebenza ezindaweni ezibonakalayo noma kuma-sandbox bese ishintsha indlela esebenza ngayo: ingena kwimodi yokulala, ikhiqize idatha engamanga, noma igweme ukwenza umthwalo wayo wangempela. Yingakho kuvamile "ukuhlela" imishini ebonakalayo ukuze ibonakale njengezinhlelo zangempela: ukulungisa inani lama-cores, usayizi wediski, ukuba khona kwamadokhumenti, ukusetshenziswa kwegundane, njalo njalo.

Uma i-malware ikholelwa ukuthi isendaweni "enobungane" (umshini wangempela noma okholisayo ngokwanele), ngokuvamile idala izindlela zokuphikelela nge-Windows Registry noma izinsizakalo zesistimu, ukuze isebenze kuyo yonke i-boot noma ukungena ngemvume. Izinkinobho ezifana ne-Run, RunOnce, Winlogon, AppInit_DLL, noma izindawo kumafolda okuqala ziyizindawo ezithandwa kakhulu abahlaziyi abaskena ngamathuluzi afana ne-Autoruns.

Amathuluzi okuhlaziya i-malware

I-arsenal yomhlaziyi we-malware ihlanganisa izinsiza ezisezingeni eliphansi kanye namapulatifomu azenzakalelayo . Alikho ithuluzi elilodwa lomlingo; isampula ngayinye ingadinga isethi ehlukile kuye ngolimi, ukupakishwa, kanye nohlobo lokuziphatha.

Emkhakheni wokuhlaziywa kwe-static, ama-disassembler nama-decompilers afana ne-IDA, i-Ghidra, ne-Radare ayagqama. Aguqula ikhodi yomshini ibe ulimi lokuhlanganisa futhi, ngokuvamile, abe yi-pseudocode yezinga eliphezulu okulula ukuyifunda. Kuma-binaries e-.NET noma e-Java, i-DnSpy ne-Jadx zisetshenziswa kabanzi.

Ama-debugger anjenge-x64dbg noma i-WinDbg akuvumela ukuthi usebenzise i-malware isinyathelo ngesinyathelo, usethe ama-breakpoint kuma-API abalulekile (ukudala inqubo, i-cryptography, ukuxhumana), futhi ubone ukuthi ilawula kanjani inkumbulo kanye nokubhalisa ngesikhathi sangempela. Amathuluzi amadala afana ne-OllyDbg noma i-Immunity Debugger asenendawo yawo, ikakhulukazi ekuhlaziyeni imisebenzi ngezikripthi ezikhethekile.

Ukuze kubonwe umsebenzi wesistimu obukhoma, kusetshenziswa ama-monitor athuthukile njenge-Process Explorer, i-Process Monitor, i-TCPView noma i-Autoruns (konke okuvela ku-Sysinternals), abonisa izinqubo, imicu, ukufinyelela amafayela, ukuxhumana kwenethiwekhi kanye namaphuzu okuphikelela ngemininingwane eminingi.

Ukuze kuhlaziywe i-PE namafomethi afanayo, amathuluzi afana ne -PeStudio, i-PE-bear, kanye ne-pefile enza kube lula ukuhlola izingxenye, ukungenisa nokuthumela okufakiwe, izinsiza ezifakiwe, kanye namasignesha asolisayo. Abahleli be-Hex abafana ne-HxD bangasetshenziswa ukuhlola noma yiliphi ifayela nge-byte futhi balisebenzise uma kudingeka.

Ithrafikhi yenethiwekhi ivame ukuhlaziywa kusetshenziswa i-Wireshark noma ezinye izihlaziyi , eziveza izizinda zomyalo nokulawula, amaphrothokholi asetshenzisiwe, idatha ehlungiwe, noma imigudu eyimfihlo. Imithetho ye-Yara, ngakolunye uhlangothi, ibalulekile ekuboneni imindeni ethile ngaphakathi kwamaqoqo amakhulu esampula.

Amathuluzi okuhlaziya nokuvikela adumile emabhizinisini

Emkhakheni wezinkampani, ngaphezu kwezinsizakalo ezisezingeni eliphansi, izinhlangano eziningi zithembele ezixazululweni zezentengiselwano kanye namapulatifomu ahlanganisiwe ukuvikela izindawo zazo zokugcina nokuhlaziya amafayela asolisayo.

Phakathi kwezinketho eziphezulu kukhona ama-suites afana ne -Malwarebytes, i-McAfee, i-F-Secure, i-AVG, i-Avast, i-Norton, i-Kaspersky, ne-Comodo , kanye nezinjini ezikhethekile nama-sandbox afana ne-Cuckoo Sandbox. Lawa mathuluzi ahlanganisa ukuhlaziywa kwesikhathi sangempela, ukutholwa okusekelwe esiginesha, ukuhlaziywa kokuziphatha, kanye namakhono okuphendula ezigamekweni.

Amapulatifomu athuthukile njenge- CrowdStrike Falcon noma i-SentinelOne ahlanganisa ukuhlaziywa kwe-malware eminikelweni yawo ye-EDR/XDR, okwenza akwazi ukubona hhayi kuphela izinhlobo ezaziwayo kodwa futhi nezinsongo ezintsha nezingenalo usuku ngenxa yokufunda komshini kanye ne-sandboxing ehlanganisiwe. Imiphumela yethulwa kuma-consoles aphakathi kanye nedatha evela kwezinye izinzwa zokuphepha.

Ngisho nezixazululo zendabuko ezifana neKaspersky Endpoint Security zinikeza izindlela eziningana zokuskena ezenzelwe ukulinganisela ukuphepha nokusebenza: ukuskena okugcwele (kuhlola inkumbulo ye-kernel, imikhakha yokuqalisa, ama-backups, wonke amadiski), ukuskena kwezindawo ezibalulekile (ukugxila kwimemori, izinqubo ezisebenzayo kanye nemikhakha yokuqalisa), ukuskena ngokwezifiso (izingxenye ezikhethwe ngumsebenzisi) kanye nokuskena kwangemuva (ukuskena okungaphazamisi kakhulu okunciphisa umthelela ezinsizeni).

Indlela i-malware ezifihla futhi izivikele ngayo ekuhlaziyweni

Ababhali be-malware bayazi kahle ukuthi izinto abazidalile zizogcina ziskenwe ngamapulatifomu okuhlaziya aku-inthanethi kanye namalebhu , ngakho-ke bafaka izindlela zokuthola nokugwema lezi zimo. Umgomo wabo ukugwema ukwenziwa ngokuphelele noma ukukhiqiza imiphumela edukisayo lapho bezwa ukuthi bayaqashwa.

Ukuhlolwa okuvamile kufaka phakathi ihadiwe kanye namapharamitha esistimu njengenani lama-processor cores, usayizi wediski, ikheli le-MAC elihlotshaniswa nemishini ebonakalayo, ulimi lwekhibhodi, igama lomsingathi noma lomsebenzisi, kanye nokuba khona kwezihluthulelo ezithile zokubhalisa eziveza izindawo ezibonakalayo.

I-Malware ingaskena nezinqubo ezisebenzayo ukuze ithole i-antivirus, i-EDR, ama-debugger, noma amathuluzi athile okuhlaziya. Uma ithola noma yiziphi zalezi zinkomba, ingamisa ukusebenza, isebenze izindlela zekhodi mbumbulu, noma imane iziphathe njengohlelo olungenangozi.

Elinye icebo elivamile ukuhlola isikhathi esidlulile noma usuku lokuqalisa , usebenzisa imisebenzi yokulala enwetshiwe ukuze uqede isikhathi sokuhlaziya sama-sandbox azenzakalelayo. Lapho ukuhlaziya kuphela futhi ifayela libuyela endaweni yangempela, i-malware iyavuka futhi iziphathe ngendlela evamile.

Ukuze izinto zibe nzima nakakhulu, abahlaseli abaningi basebenzisa ama-crypter nama-packer abhala noma afihle i-binary yokuqala. I-Builder ikhiqiza i-executable yokugcina enezingqimba eziningi zokuvikela, kanti i-Stub inesibopho sokususa ukubethela nokuqalisa umthwalo wangempela, ngokuvamile ngqo kwimemori (isikhathi sokusebenza) esikhundleni sokuwubhala kudiski (i-scantime), okwenza ukubanjwa kwayo nokuhlaziywa okulandelayo kube nzima kakhulu.

Izindlela zokuhlaziya eziqinile neziguquguqukayo ekusebenzeni

Ekuhlaziyweni okuqinile okungaguquki, umhlaziyi ugwema ukwenza isampula futhi ugxile ekukhipheni, ekususeni, nasekuqondeni i-logic yangaphakathi . Izintambo zikhishwa kusetshenziswa izintambo noma amathuluzi e-FLOSS (athola izintambo ezisusiwe ngesikhathi sokusebenza), ukungeniswa kwe-API kuyabuyekezwa ukuze kunqunywe ukuziphatha, futhi imindeni ikhonjwa kusetshenziswa imithetho ye-Yara.

Isinyathelo esilandelayo ngokuvamile sihilela ukuhlukaniswa kanye nokuhlukaniswa , ukutadisha ukugeleza kohlelo, imisebenzi ebalulekile, kanye nokuvinjelwa kwekhodi okungenzeka okuhlobene nokubethela, ukuxhumana okukude, ukuphikelela, noma ukwanda kwamalungelo. Ukucushwa kwangaphakathi kwe-malware (amaseva e-C2, okhiye bokubethela, izindlela zokufaka) kuvame ukufunwa ukuthola ama-IoC anenani eliphezulu.

Ekuhlaziyweni okuguquguqukayo, ngendawo echazwe kahle, isampula isetshenziswa ukuqinisekisa imibono edalwe ekuhlaziyweni okumile . Ukudalwa kwenqubo, ukuguqulwa kwamafayela, ukubhala kurejista ye-Windows, ithrafikhi yenethiwekhi, ukudalwa kwensizakalo, kanye nama-mutexe kuyaqashwa. Lonke lolu lwazi luhlobene ukuhlonza nokuchaza usongo.

Amathuluzi okuhlaziya aku-inthanethi ahlanganisa zombili izindlela futhi angaba yisinyathelo sokuqala esihle. Kodwa-ke, awawona amaphutha : angase aphuthelwe imindeni emisha noma engaziwa kakhulu, kodwa ngokuvamile anikeza izinkomba ezanele kanye nama-IoC ukuze kudingeke uphenyo olwengeziwe nolujulile lwelabhorethri.

Ngalo lonke lolu hlelo, abahlaziyi bayakwazi ukunikezela igama kumndeni noma uhlobo oluthile , babhale phansi ama-TTP alo, futhi bakhiqize imithetho evumela ukuthi liqashelwe kwezinye izinhlelo noma imikhankaso yesikhathi esizayo, ngaleyo ndlela bavale umjikelezo phakathi kokuhlaziya nokuzivikela.

Esimweni lapho amakhulu amasampula amasha embulwa nsuku zonke, ukuba namakhono okuhlaziya i-malware aqinile kwenza umehluko phakathi kokuhlala ulandela abahlaseli isinyathelo esisodwa noma ukulindela ukunyakaza kwabo, ukuthola nokuvimba izinsongo ngaphambi kokuba zibe yinkinga enkulu kubasebenzisi nezinhlangano.