---
# System prepended metadata

title: 'MalConfScan with Cuckoo: Automatic Malware Configuration Extraction System'
tags: [CODEBLUE, CODEBLUE2019]

---

MalConfScan with Cuckoo: Automatic Malware Configuration Extraction System
===

:::info
- **Date:** Oct.29th 13:10-13:40
- **Speaker:** Tomoaki_Tani,Shusei_Tomonaga
- **Category:** Bluebox - 1F HALL

> Overall, malware activity is increasing day by day; the automation of malware analysis using sandbox system has become widespread. Such automated analysis systems are created to clarify the behavior of programs on Windows, such as communication and file registry creation. However, malware analysts spend more time extracting the configuration data embedded in the malware than grasping such behavior of the malware.<br><br>There are two reasons. The first is that many malware variants only differ in their configuration data, and have the same code. It means that the analysis of malware is complete if only the malware type and setting configuration are known. The second reason is that malware configuration data often contains attacking campaign information and the encryption keys of malware communication. These pieces of data are essential clues in advancing incident response. However, such data is often encrypted and can not be easily extracted. It is necessary to clarify the details of each malware by static analysis to extract the configuration data.<br><br>To bridge the gap of the sandbox system and malware analysts, we developed a new tool. It supports the task of extracting malware configuration data for malware analysts and incident responders. With these tools, we could automatically extract the known malware's configuration data and reduce the time spent on malware analysis. Furthermore, these tools can also use for memory forensics. By using it in memory forensics, victims affected by a malware infection can quickly obtain the data necessary for investigating, such as the destination hosts associated with the malware and the communication encryption keys.
:::

###### tags: `CODEBLUE2019`,`CODEBLUE`
