#HITB2014KUL White Paper: IRMA - An Open Source Platform for Incident Response & Malware Analysis
Authors: Guillaume Dedrie, Fernand Lone-Sang, Alexandre Quint - Quarkslab
Testing suspicious files against major anti-virus engines is only a first step. When an analyst detects such a file, he might want to apply custom analyses and transformations on this file, like running it in a sandbox for instance, or statically analyz- ing the file, which requires first unpacking it most of the time. IRMA enables you to append your custom analyzers (static file analyzers, sandboxes, etc.) and your own tools (unpackers, disassemblers, etc.) to ones that are available and shared by the community with the objective of assisting a malware analyst in extracting as relevant information as possible from a suspi- cious file.
Furthermore, today's defense is not only about analyzing file. IRMA can help you in getting a fine overview of the incident you dealt with: where and when a malicious file has been seen, who submitted a hash you keep a watch on, where in your information system a hash has been found, which anti-virus detects it, etc.
IRMA is still a young project. Up to now, we focused our efforts on instrumenting multiple anti-virus engines running either on Microsoft Windows or GNU/Linux systems. Thus, in this lab, we describe first the overall architecture of IRMA, which has been designed as a 3-part system. Then, we guide you in setting up your own platform inside virtual machines. Finally, we develop together a new analyzer and include it to your own IRMA setup. By the end of the lab, if you want to support this ambitious project or to reuse it, feel free to join the community: to contribute to it by submitting the analyzer you have devel- oped or to come to see us and discuss the mechanics under the hood.