Table 11.1
Preparation and Verification Checklist: What to Install before Loading the Malware Specimen
	
Analysis Step	Activity 	Purpose of Action	Location of Tool	Check
When
Done	
Static analysis—
Virus scan	Update antivirus
signatures	To prepare an antivirus tool to detect various forms of malware, including specimens with newer signatures.	Antivirus software company	°	
Static analysis—
Strings research and
other binutils tools	Verify the installation of the strings command (UNIX and Windows), as well as other binutils programs (nm, objdump, etc.)	To display contiguous sets of ASCII characters included in a file. Most UNIX systems have a built-in strings command. On Windows, I use the free, open-source version of Windows strings from Sysinternals. I also make sure that other binary analysis utilities, such as nm and objdump, are installed.	Built in on UNIX. Windows tool available at www.sysinternals.com	°	
Dynamic analysis—
File integrity checking	Run file integrity checker and reconcile any changes	To verify that system is in a known trusted state before the malware makes any changes.	File integrity checking program distributor	°	
Dynamic analysis—
File monitoring	Verify the installation of the Filemon program (Windows and Linux)	To provide a dynamic update of all file system activity, indicating which processes are opening, reading, and writing files. It runs on both Windows and Linux systems.	www.sysinternals.com	°	
Dynamic analysis—
Process monitoring	Verify the installation of the Process Explorer program (Windows)	To identify the resources used by all running processes, including DLLs and registry keys. Process Explorer provides a wealth of useful information regarding how malware is impacting a victim machine.	www.sysinternals.com	°	
Dynamic analysis—
Process monitoring	Verify the installation of the lsof and top tools (UNIX)	To show which files each running process is reading and writing, as well as the TCP and UDP ports each process is using.	freshmeat.net/projects/lsof/ and www.groupsys.com/top/	°	
Dynamic analysis—
Network monitoring	Check which ports are running locally, using Fport or TCPView on Windows and lsof on UNIX	To see which TCP and UDP ports are listening on the trusted system, to act as a comparison point after the malware is installed.	www.foundstone.com and www.sysinternals.com	°	
Dynamic analysis—
Network monitoring	Conduct a port scan from across the LAN, using the Nmap port scanning tools	To verify the results of the local port check by comparing them to a remote port scan.	www.insecure.org	°	
Dynamic analysis—
Network monitoring	Conduct a vulnerability scan from across the LAN, using Nessus	To look for backdoor listeners recognized by Nessus.	www.nessus.org	°	
Dynamic analysis—
Network monitoring	Verify the installation of a sniffer on a separate system on the LAN.	To gather all traffic going to and from the target system, using a sniffer loaded on a system other than the victim machine. If the malware tries to send something across the network, I want to gather all packets to see what is happening. For a sniffer, I usually run the Ethereal program. Other sniffers you might want to use include tcpdump and Snort.	www.ethereal.com/download.html, www.tcpdump.org, and www.snort.org	°	
Dynamic analysis—
Network monitoring	Verify the installation of the TDImon tool (Windows)	To record all TCP and UDP activity on a Windows machine. Beyond merely listing the ports in use (which Fport and TCPView do quite well), this program shows when various running programs send data out through a port or receive incoming data on a port.	www.sysinternals.com	°	
Dynamic analysis—
Network monitoring	Verify the installation of a promiscuous mode checker: ifconfig (UNIX), ifstatus (Solaris), and Promiscdetect.exe (Windows)	To determine if the network interface is running in promiscuous mode, gathering packets destined for all systems on the LAN. On most stock UNIX systems (other than Linux and Solaris), I rely on ifconfig for this purpose. On Solaris machines, I use ifstatus. On Windows, the Promiscdetect.exe program identifies promiscuous mode
for me.	www.ntsecurity.nu/toolbox/promiscdetect/) and www.cymru.com/Tools/	°	
Dynamic registry
monitoring	Verify the installation of Regmon (Windows)	To display a real-time indication of all registry activity, including creating, reading, and writing registry keys.	www.sysinternals.com	°	
All analysis steps,
for verification	Verify that CD-ROM with other analysis tools is ready
	•	Everything listed above
	•	Disassembly/debugging tools
	•	Reverse compiling tools	To check the veracity of the results from various tests, and to conduct additional tests using trusted binary executables. Also, to perform detailed code analysis		°