#HITB2014KUL White Paper: IRMA - An Open Source Platform for Incident Response & Malware Analysis

The acronym IRMA stands for “Incident Response & Malware Analysis”. It is an open-source platform designed to help identify and analyze suspicious files by providing a central place where those files can be tested towards major anti-virus engines. Contrary to popular automated malware analysis platforms such as VirusTotal1, Metascan2, Camal3, Malwr4 or AVCaesar5, IRMA attaches importance to you keeping control over where your files go and, more importantly, who gets your data. Once you install IRMA on your network, your data stays on your network, samples are not shared with the anti- malware or the security industry if not desired and the results of their analysis stay private.

Testing suspicious files against major anti-virus engines is only a first step. When an analyst detects such a file, he might want to apply custom analyses and transformations on this file, like running it in a sandbox for instance, or statically analyz- ing the file, which requires first unpacking it most of the time. IRMA enables you to append your custom analyzers (static file analyzers, sandboxes, etc.) and your own tools (unpackers, disassemblers, etc.) to ones that are available and shared by the community with the objective of assisting a malware analyst in extracting as relevant information as possible from a suspi- cious file.

Furthermore, today's defense is not only about analyzing file. IRMA can help you in getting a fine overview of the incident you dealt with: where and when a malicious file has been seen, who submitted a hash you keep a watch on, where in your information system a hash has been found, which anti-virus detects it, etc.

IRMA is still a young project. Up to now, we focused our efforts on instrumenting multiple anti-virus engines running either on Microsoft Windows or GNU/Linux systems. Thus, in this lab, we describe first the overall architecture of IRMA, which has been designed as a 3-part system. Then, we guide you in setting up your own platform inside virtual machines. Finally, we develop together a new analyzer and include it to your own IRMA setup. By the end of the lab, if you want to support this ambitious project or to reuse it, feel free to join the community: to contribute to it by submitting the analyzer you have devel- oped or to come to see us and discuss the mechanics under the hood.