Recover Quarantined Malware
Source: YouTube · John Hammond · published Aug 16, 2024 · 25:08
This video demonstrates how to recover original malware files from antivirus quarantine data using the Perl script dxr, originally created by researcher Adam (hexacorn) 0:36-0:41. The host validates this by successfully retrieving a Mimikatz sample that was quarantined by both Windows Defender and Malwarebytes 19:06-19:23.
Key Takeaways:
• The dxr tool addresses the common issue where analysts lack raw malware samples but have access to quarantine data, utilizing XOR operations to decrypt files 0:00-0:18.
• Supporting a wide range of engines including Windows Defender, Malwarebytes, AVG, and BitDefender, dxr serves as a versatile utility for digital forensics and incident response 4:00-4:29.
• In a demo using a Windows VM, Mimikatz is quarantined by Defender, and the resulting data from C:\ProgramData\Microsoft\Windows Defender\Quarantine is processed on a REMnux machine 13:23-15:12.
• The recovery is confirmed by comparing the SHA256 hash of the extracted file against the original Mimikatz executable, proving the tool's accuracy 17:40-18:10.
• The process is replicated with Malwarebytes by extracting data from C:\ProgramData\Malwarebytes\MBAMService\Quarantine, demonstrating compatibility with different vendors 20:05-22:05.
By leveraging dxr, security professionals can reverse engineer malware even when only quarantine artifacts remain, significantly enhancing their investigative capabilities 24:40-24:53.
Sources:
- 0:00-0:18 Introduction to the quarantine recovery prob
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Malware Analysis. Commonly maps to: Security Operations, Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
one of our security Operation Center analysts was investigating a case to do some digital forensics and incident response they wanted to analyze a suspicious file or do what would ultimately be reverse engineering some computer malware but they didn't have the original file itself they didn't have the raw malware sample all they had was the quarantine data that was set aside by the antivirus solution think like malware bites or AVG your web rout or even windows Defender any antivirus it left the question can you recover the original file from the quarantine data of an antivirus engine so in this video I'm going to answer that question yes and show you a really cool tool in case you haven't seen it before as to just how easily you can recover any original file or malware sample from antivir…