So the btcarmory.org has been suspended and is empty. However I was able to pull off the "installers" using a VM before it was taken down, and currently have them in a tar archive waiting for... something! Anyone have recommendations for how to go about analyzing the executables and figuring out what they do? I'm super interested to know how they decided to "attack" you. Whether it was simple wallet stealing, some kind of trojan, or maybe even unrelated malware that does other things.
I know there's only so much you can do with a compiled binary, but I suspect there are people that know how to properly isolate and monitor the executable while it's running. I'm envisioning low-level tracing of system calls, network accesses, disk accesses, etc, while running it in a VM.
I'm not going to post the malware downloads publicly, but if someone has background to analyze them, or connections that do, I'll be happy to send them. I have both a Windows .exe, and more interestingly (to me) a Linux/ELF "armoryamd64.out".
I know there's only so much you can do with a compiled binary, but I suspect there are people that know how to properly isolate and monitor the executable while it's running. I'm envisioning low-level tracing of system calls, network accesses, disk accesses, etc, while running it in a VM.
I'm not going to post the malware downloads publicly, but if someone has background to analyze them, or connections that do, I'll be happy to send them. I have both a Windows .exe, and more interestingly (to me) a Linux/ELF "armoryamd64.out".
Remember that it might behave differently under a VM if the author of the malware foresaw people would want to find out how it works under the hood.
