How to obtain malware for analyzing

For malware analyzing you need to obtain some malware that is around in the field right now. Their are severable ways of obtaining malware for analyzing. But before you go and check out the following steps i recoment you use virtual machine.

Easy ways of obtaining malware is by joinging sketchy forums, sign up for spam mails or try and download some free generators/cheats for games.

Check out ‘Malshare.com,’ it is a website where you can actively download malware shared by others. It provides an opportunity to explore and access various types of malware.

Tool 1: Virtual machines

When it comes to dealing with malware, one essential tool to have is a virtual machine. The primary purpose of using virtual machines is to ensure the safety of your own system and prevent accidental loss of files. Thankfully, there are various options available for creating virtual machines, both free and paid. Prominent examples include “VirtualBox” and “VMware.”

Once you have set up a virtual machine, you can choose to install either Windows or Linux. A Linux distribution called Remnux stands out as it offers a comprehensive set of tools specifically designed for reverse engineering malware. By using a virtual machine, you can execute viruses and observe their behavior. While easily restoring the system to its previous working state with the help of a snapshot.

IMPORTANT: ENSURE THAT YOUR ENVIRONMENT REMAINS COMPLETELY ISOLATED TO PREVENT ANY POSSIBILITY OF A BREAKOUT.

Tool 2: Wireshark

Wireshark is a crucial tool for analyzing malware and understanding its behavior. It captures and analyzes network traffic, allowing you to identify communication patterns and command and control servers used by the malware. It helps detect malicious traffic, reconstruct malware activities, and is best used in combination with a virtual machine for a safe analysis environment.

While there are other network capturing software options available, Wireshark is the preferred choice for most analysts due to its free availability and extensive community support. It has a large user base and a wealth of resources, including courses that teach you the intricacies of this powerful software.

Tool 3: Any.run

Any.Run is a platform designed for malware reverse engineering. It offers a virtualized environment, similar to a virtual machine with Wireshark installed. Enabling analysts to safely dissect and analyze malicious code. Let’s explore why Any.Run is a standout tool for reverse engineering malware.

1. Safe Virtual Environment: Any.Run provides a secure sandboxed environment, protecting the host system while allowing analysts to dissect malware.
2. Streamlined Workflow: The platform offers an intuitive interface for effortless upload, execution, and real-time monitoring of malware samples.
3. Comprehensive Behavior Analysis: Any.Run captures and analyzes dynamic malware behavior, enabling researchers to gain valuable insights into malicious tactics.
4. Network Traffic Visibility: With integrated Wireshark, Any.Run allows detailed examination of malware’s network traffic, revealing command-and-control infrastructure and data exfiltration techniques.
5. Collaborative Approach: Any.Run encourages collaboration among researchers, facilitating knowledge sharing and collective defense against evolving cyber threats.
6. Informative Reports: The platform generates detailed reports and captures forensic artifacts, providing vital information for incident response and further investigations.

Whether you’re a beginner or an experienced analyst, Any.Run is a valuable tool for diving into the world of malware analysis. It provides a supercharged magnifying glass for dissecting malicious software and understanding its inner workings. While the paid version unlocks additional features, the free version still offers a robust set of tools to kickstart your journey into malware reverse engineering.

Tool 4: Virus Total

VirusTotal is an online service that provides a convenient method to swiftly determine if a file or URL contains any detected viruses. It employs a range of antivirus engines and security tools to enhance the accuracy of malware detection. By leveraging the collective knowledge and expertise of the cybersecurity community, users gain access to a collaborative platform.

VirusTotal incorporates static and dynamic analysis techniques, along with an extensive database of previously scanned files, which aids in malware analysis and research. In summary, VirusTotal serves as a valuable resource for promptly verifying if a file or URL is flagged as malicious, identifying the specific antivirus scanners that detected it, and determining its malware family or type. This capability proves invaluable when you need to quickly assess the detection status and behavior of potential threats.

Tool 5: DIE Detect it EASY

Detect It Easy (DIE) is a versatile file analysis tool that operates across multiple platforms. Its primary function is to determine the types of files by utilizing detection signatures, while also providing the option for customization through scripts. DIE supports various file formats and proves particularly useful for malware analysis.

Key features of DIE for malware analysis include:

1. File Identification: DIE excels at accurately identifying file types, aiding analysts in classifying and comprehending malware.
2. Signature-based Detection: By utilizing pre-established signatures, DIE can effectively detect known malware patterns and characteristics.
3. Open Signature Architecture: Users have the freedom to customize existing detection algorithms or create new ones using scripts. This flexibility allows for tailored and adaptable malware analysis.
4. Versatility: DIE is capable of recognizing a broad range of file formats, including executable files that are frequently employed by malware.
5. Compilers/Obfuscators Detection: DIE possesses the ability to detect the specific compilers or obfuscators employed in the creation of files, and it may even offer the potential for their reversal.

By utilizing DIE, analysts can easily identify suspicious files, classify malware samples, and develop customized detection rules, thereby enhancing their malware analysis capabilities.

Tool 6: Hexrays/ Ghidra

Ghidra stands out for its extensive capabilities, including the ability to disassemble, decompile, and debug various types of executable files. It serves as an indispensable tool for reverse engineering malware, allowing analysts to gain deep insights into its inner workings.

With Ghidra, analysts can explore the code, data structures, and control flow of malware, providing valuable knowledge for analysis and mitigation. The tool offers a user-friendly interface and a robust scripting environment, enabling users to automate analysis tasks and even create custom analysis tools tailored to their specific requirements.

Hex-Rays is a commercial software extension widely used for disassembly. It specializes in the decompilation of binary code into a high-level programming language representation, such as C. This process of converting the code into a more human-readable form facilitates a better understanding of the functionality and logic employed by the malware.

It is worth noting that both Ghidra and Hex-Rays have a learning curve that may appear daunting at first. However, the investment of time and effort in mastering these tools proves worthwhile for individuals seeking to delve into malware analysis and reverse engineering. The insights gained from utilizing these tools can be invaluable in combating and staying ahead of evolving malicious software threats.

The post 6 Tools to start reverse engineering malware? appeared first on IT-Tutorial.

What can be their goals?

One common way that typosquatters achieve their goal is by creating a fake login page that closely resembles the real login page of the popular website. When a user types in the correct website address but makes a typo, they may end up on the fake login page, where they will enter their login information without realizing that they are on a fraudulent website. The typosquatter can then use this information to gain access to the user’s account on the legitimate website.

Another tactic used by typosquatters is to create websites with content that is similar to the content on the legitimate website. For example, a typosquatter might create a website with fake news stories that closely resemble the stories on a popular news website. When a user mistypes the website address and ends up on the fake website, they may believe that they are reading real news stories and not realize that they are on a fraudulent website.

How to detect typosquatting?

Typosquatting can be difficult to detect and prevent, but there are a few steps that individuals and organizations can take to protect themselves. First, users should always double-check the website address before entering sensitive information to make sure that they are on the correct website. Second, organizations can register common misspellings of their domain name to prevent typosquatters from registering these domain names. Finally, organizations can use a web application firewall to detect and block traffic from known typosquatting websites.

conclusion

In conclusion, typosquatting is a serious threat to individuals and organizations, and it is important to be aware of this type of attack and take steps to protect yourself. By being vigilant and taking the appropriate precautions, you can help to prevent yourself from falling victim to a typosquatter.

If you found this interesting I would greatly appreciate it if you check out one of my other posts.

• IT-Tutorial.info

Or support me using: “Buymeacoffee“

The post What is typosquatting and how can you prevent it! appeared first on IT-Tutorial.

So I started to look around for a screen protector that was not too expensive. I managed to find a screen protector for 10 euros, its called LK film screen protector.

One of the biggest problems you normally have is getting a good installation without any air bubbles. This Screenprotector makes it really easy.

I have made some pictures while installing it on my Samsung Galaxy S10. I would like to show a few. Just know that they also have this screen protector for almost any iPhone and Samsung device.

The following picture is my personal review

If you found this interesting I would greatly appreciate it if you check out one of my other posts.

• IT-Tutorial.info
• Amazon link

The post This screen protector is the easiest installation ever appeared first on IT-Tutorial.

What are the minimum requirments for a good and secure password?

• Password length (min 8 characters)
• Numbers (1234)
• Upper cases (ABCD)
• Lower case (abcd)
• Special symbol (!@#$%)

def password_check(passwd): 
      
    SpecialSym =['!', '@', '#', '$', '%', '^', '&', '*'] 
    val = True
      
    if len(passwd) < 8: 
        print("Lengtt should be atleast 8 characters") 
        val = False
          
    if len(passwd) > 20: 
        print("Password should not exeed 20 characters") 
        val = False
          
    if not any(char.isdigit() for char in passwd): 
        print('Password should contain a digit') 
        val = False
          
    if not any(char.isupper() for char in passwd): 
        print("Password should contain atleast 1 upper case") 
        val = False
          
    if not any(char.islower() for char in passwd): 
        print("Password should contain atleast 1 lower case") 
        val = False
          
    if not any(char in SpecialSym for char in passwd): 
        print("Password should contain 1 or more symbols like: !@$") 
        val = False
    if val: 
        return val 
   
def main(): 
    passwd = input("Enter your password : ")
      
    if (password_check(passwd)): 
        print("Password is valid") 
    else: 
        print("Invalid Password !!") 
                
if __name__ == '__main__': 
    main() 

If you liked this post and learned something new I would really appreciate it if you check out some of my other posts.

The post Create a simple python password checker. appeared first on IT-Tutorial.

1. Put your mouse where you want the table of contents to be placed.
2. Go to References > Table of contents and choose an automatic style as shown in the picture.

3. If you make changes to your document that affect the table of contents, update the table of contents by right-clicking the table of contents and choosing Update Field.

4. You have succesfully created an table of contents. if in doubt or have other questions leave a message.

Read one of my other tutorials that might apply to you like, Automatic outlook signature.

The post Word automatic table of contents (Index) appeared first on IT-Tutorial.

Index

• Download Hirens Iso
• Formatting USB Flash Drive
• Installation
• How to use?

Step 1: Download

Visit the site of Hirens BootCD and download the latest version (link). The download button is all the way down at the bottom of the page.

Step 2: Formatting your flash drive

Format your USB flash drive with windows formating. (right click on your drive and select format).

Step 3: Installation

For this installation you can use Rufus or the downloaded file from above.

Install Hirens Flash Boot and launch it.

Select the USB drive you want to use. Then click on the search icon select the hirens iso file. If you have completed that click on “Process”, You will see a process bar at the bottom

When finished you will see the following message.

Close the program and eject your hard drive!

How to use:

Short explained: Reboot your laptop/computer/server with the usb flash drive plugged in. Note your boot option should be USB first than your main hard drive.

The post Hirens BootCD Flash Drive appeared first on IT-Tutorial.

Table of Contents

• Install Active Directory
• Setup Domain Controller
• Conclusion

Note: You need to have administrator privileges on the server to install AD

Install Active Directory

Login to the server, and click on the Start button, and then click on Server Manager:

On the Server Manager Dashboard, click on Add roles and features:

The Add role and features wizard will come up:

Click on Next. On the following Installation type screen, choose the first option “Role-based or feature-based installation:

Click on Next. On the following screen select a server from the server pool. your local server should be listed:

On the following screen click on Active Directory Domain Services and the Add features window will pop-up:

Click on Add Features and then click on Next. Make sure .NET 4.6 Features are checked on the following screen:

Then click on Next. On the following screen you will get a short overview of what a domain controller does, and the services that get installed. if this is your first domain controller you will be prompted to install the DNS service which is required on a domain controller:

Click on Next. click on Install on the confirmation window:

The Installation will begin:

Setup Domain Controller

Once the AD role has been installed. click on Promote this server to a domain controller:

And the deployment configuration wizard will come up. Select Add new forest and choose your Root domain name:

click on Next. on the next screen choose your Forest functional level and enter the Directory Service Restore Mode password: If this is your first domain controller choose “Windows Server 2016” as the Forest and Domain functional level. make sure the DNS option is checked, and because this is my first server, the Global Catalog ( GC) is already checked. click on Next: Skip the DNS options

Choose the NetBIOS domain name (already selected ) and click Next choose the paths for the the AD database, normally the defaults are OK

Review Options:

Click on Next.

Do the Prerequisites check. if all the prerequisites check successfully. click on Install

The Installation should begin. the server will reboot automatically when the installation finishes:

This message will pop-up on your screen when Windows Server 2016 is about reboot:

After your server reboots, you will have the option to login to your newly created network:

after you’re logged using your domain credentials, go to Administrative tools and open Active Directory Users and Computers to make sure your AD is working:

Conclusion

As you can see, installing Active Directory (AD) in Windows server 2016 is not much different than Installing AD in previous Windows server releases. I hope you found this guide useful. If you have any question please use the comments section below

The post How to setup Active Directory (AD) In Windows Server 2016 appeared first on IT-Tutorial.

Index

• Outlook
• Gmail
• Yahoo Mail

“insert image here”

Outlook

How to track anonymous email using outlook.

Step 1

Start your Outlook application. Double click on the anonymous message in your inbox to open it in a new window.

Step 2

Click “File” at the top left of the screen to open the File Menu. Select “Properties”. Select the “Details tab”. Click on “Message source”. This will open the full headers for the email, including the IP address (Link IP address explained) of the sender.

Step 3

Navigate to an IP tracking site such as IPchecking.com, IPtrackeronline.com or iplocation.net. Copy and paste the IP address from the anonymous email you found into the appropriate field.

These trackers may give you the following information. Name, Address of the sender, if not it may give you a location or other useful data that will help you track down the sender.

Gmail

How to track anonymous email using gmail.

Step 1

Launch gmail and open the anonymous email you would like to trace.

Step 2

Click on the tree dots (located next to the “Reply button”). Choose “Show original”, This will open a new window with the full email header. in here you will find the sender’s IP address.

Step 3

Navigate to an IP tracking site such as IPchecking.com, IPtrackeronline.com or iplocation.net. copy and paste the ip address here. The tracking site might give you some useful information.

Yahoo mail

Step 1

Launch yahoo mail. Open the email you want to trace

Step 2

Click on the cogwheel icon with the downwards pointing arrow to open the more actions menu. Click “view full headers”.

Step 3

Launch an IP tracking site or an email address tracking site. Copy and paste the originating IP or the full email header as appropriate. Record any information that the IP or email tracking site returns.

Tips

• Save anonymous or harassing emails and keep a detailed record of everything you find out. This may be useful if your planning on taking actions later.
• If the emails are abusive or threatening, contact your local authorities. You could also contact the sender’s parents, educational establishment or an employer.

Warning

• Always stay calm and respond appropriately to anonymous emails. They can be annoying and even distressing, but responding in kind or becoming abusive can escalate conflicts and may even get you some legal trouble.
• What you do with the information of the sender is your own responsibility use it carefully.

If you found this article helpfull and fun check out my other articles.

The post How to find anonymous email sender appeared first on IT-Tutorial.

This is a quick tutorial about how to make a bootable usb drive for any iso file. using software called Rufus

Download and install Rufus

Visit the rufus site and download 3.8

Insert USB and start Rufus

Insert a usb drive in to your computer and remove all data from it. Then start the Rufus application you downloaded in the step above.

Select your device (USB drive name)

Select your ISO File

Click on select and choose the location where iso file is saved. then click on start.

When finished close Rufus and remove the USB drive. if you have finished all the steps the USB drive will be bootable.

Be sure to check out my other posts on this website.

The post How to create a bootable USB drive appeared first on IT-Tutorial.

If you are setting up Windows Server 2016 as a domain controller or as any other production server function in your network it is recommended that you set it up with a static IP address. This is a quick how to guide on how to do that.

Note: you need an administrator account on the server to set your Windows 2016 server with a static IP address 

Login to your Windows 2016 server, and click on the Start button, and then click on the Control Panel:

Then click on View network status and tasks under the Network and Internet applet:

Then click on Change adapter settings on the left menu:

then right-click on your network connection, and select Properties:

Select Internet Protocol Version 4 (TCP/IPv4) and then click on Properties:

Enter the IP address you want to assigned to this server, the Network Mask, Default Gateway, and the DNS IP address:

Click  OK and then reboot the server.

The post Set Windows Server 2016 with a static IP address appeared first on IT-Tutorial.