AMIRA: Automatic malware analysis

AMIRA is an automatic service  in the OSXCollector files. Automated analysis is performed via OSXCollector output filters.

More specifically, with One Filter to Rule Them All. AMIRA takes care of retrieving the output files from an S3 bucket, running the analysis filter, and then uploading the analysis results back to the S3.

Architecture

The service uses S3 bucket event alerts to enable resolution. You will need to configure an S3 bucket for the OSXCollector output files so that when a file is added there, the notification will be sent to a series of SQS (AmiraS3EventNotifications in the image below).

AMIRA periodically checks the queue for any new messages and during of will get the OSXCollector output file from the S3 bucket. It will then run the parsing filter on the recovered file.

The analysis filter sequentially executes all the filters contained in the OSXCollector output filters. Some of them communicate with external resources such as hashes and use Intel API threat engines, e.g. VirusTotal, OpenDNS Investigate or ShadowServer.

The initial output of OSXCollector extends to all of these and the last filter run by the analysis filter summarizes all the findings in human-readable form. Once the filter is complete, the analysis results will be loaded into the S3 results analysis bucket

 

Information about the installation and the use of the program, you will find here.

iGuRu.gr The Best Technology Site in Greecefgns

every publication, directly to your inbox

Join the 2.100 registrants.

Written by Anastasis Vasileiadis

Translations are like women. When they are beautiful they are not faithful and when they are faithful they are not beautiful.

Leave a reply

Your email address is not published. Required fields are mentioned with *

Your message will not be published if:
1. Contains insulting, defamatory, racist, offensive or inappropriate comments.
2. Causes harm to minors.
3. It interferes with the privacy and individual and social rights of other users.
4. Advertises products or services or websites.
5. Contains personal information (address, phone, etc.).