Giters

rieck / malheur

A Tool for Automatic Analysis of Malware Behavior

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Additional apt until how to know complete installation of Malheur ?

wangjingan opened this issue · comments

commented

currently i'm taking my thesis firstly trying to learn the essence of this Malheur. What stumbled me first, due to my lack of knowledge about installing via VM and Linux (in Ubuntu server 12.04) command.
I am wondering that, there are some sort of additional application needed by fully running these two:
libconfig-1.4.9.tar.gz
libarchive-3.1.2.tar.gz(Stable one according to its original web)

Some of those additional applications are:
Gcc
G++
flex, bison (these 2 are optional, tho i'm still tempted to include them)
PKG-CONFIG
zlib-1.2.8 (currently this is the newest stable)

1
now i can run Malheur, yet i'm just afraid that because off redundancy package that is not really needed might jumbled everything. Or is it just fine since i did:

  • find in /usrl/local/bin/...malheur (in green color)
    2
  • and malheur can be executed anywhere, now i just need to figure out how to put dataset.zip in there, run it, and then i can learn its essence.

wrapping up those questions above:

  • are those packets using apt-get are not going to be hindrance for malheur? or simply, just knowing malheur can run, there is no need to worrysome :> ?
  • how exactly can i run dataset.zip from malheur? important
commented

There seem to be several issues here:

  • I fixed the unfortunate segfault in your first screenshot. bfbbd72
  • You don't need to run Malheur with root privileges. Use the configure option --prefix to select another directory.
  • AFAIK Debian/Ubuntu should come with all required packages. No need to manually compile them.
commented

Thank you very much for the very fast respond Mr. Rieck, now i have come up with another error.

This happened after i run this command:
" malheur -o out.txt -v cluster binary20080901_binary_tar.gz "

i understand very well with malheur command options and else, such as prerequisite of:

  • shared folder access (currently need root to get into the directory, "sf_malheur"):
    and the folder is not empty, due to Malhuer Manual - Bugs part, that warning may appear if the tar.gz file is empty (if im not mistaken) so i put printscreen below that enhance the command that i used above should be error free.

sf_malheur

but Problem:
omgwhatisthis

i do not understand what happened, (wrong installation? need another configuration? (i did follow the configuration from malheur manual).

commented

You are attempting to cluster malware binaries directly. However, Malheur is designed to analyze program behavior and not executable files. You can experiment with either the MIST or CWSandbox representation of program behavior available on the webpage. Note that you need to change the configuration file accordingly.

It might also help if you inspect the data you attempt to cluster beforehand. You will get a better understanding of the results produced by Malheur.

I am closing this issue now.