Potential Goals and milestones

[Evan-Sa]

I have a short list of ideas for 2018 that I was interested in for ssma development. I wanted to hear some feedback on these ideas before going forward.

Create on option that Prints detailed yara results that show what strings hit on the sample

Display Marco Offsets in the same way that oledump or oletools does

Develop a detailed display option that Dumps PE and PE sections info in the same way manalyze or Pecheck does (header, sections, etc...)

Develop a framework for static analysis

Create an output to CSV or PDF report option

write a simple cheat sheet the commands are little confusing (I've had feedback were people didn't realize you needed a period to do the directory scan or couldn't get the virus total option to work embarrassingly I still don't know how to use that feature.

[pielco11]

I've others ideas too, like setting up a remote-scan-service so that on could:

• scan locally and share the reports with the server;
• scan remotely and share the reports with the server.

So that one well be able to compare malware, download and/or upload reports, etc.
One could choose to share its stuff with everyone, with its team or with no one, also could choose to delete the malware after analysis or keep it available for everyone. In other words a complete control of the stuff. Others ideas are ready to come.

I have a server so that I could host it by myself.

[Evan-Sa]

I think that would be a very valid use case. Most of analysis needs to stay local but having that DB resource for intelligence is very useful. I have not seen many great solutions would this be a username/password setup were people request access. Or your analysis gets a generated Id number and you can use that Id # with command options share publicly, share with certain users, delete the reporte

[pielco11]

Now as now my plans are these:

• auth with pass (key) and user;
• full control of sharing policy.

Users will sign up freely and will have unmetered scan requests, this could change during time based by load and in this case I could limit the number of requests per specific time range to not overload the server and to give everyone a stable service.

Passwords and usernames will be protected with salt, pepper, PBKDF2 and friends.

With "full control of sharing policy" I mean, but it's not limited to:

• choose if one wants to share samples with no-one/a specific team/everyone;
• choose if its (of the user) details will be available publicly, in this case "date" and "username" will be shared (e.g.: user: MarioBros date: dd-mm-yyyy sha512: 123...);
• choose to share the reports with no-one/a specific team/everyone;
• in any case I will not keep IPs or any identifiable information.

For example: a registered user could choose to upload a sample as anonymous, don't store the sample but share the report.

I'm widely open to every suggestion.

[pielco11]

@Evan-Sa I found this interesting repo that I forked (to add minor enhancements), check it out, I think that could be useful

[Evan-Sa]

@pielco11 I downloaded your fork I found it pretty helpful. I would like to the see the same output in ssma when you sue the document flag. I am looking into a detailed display for the matching strings in yara signatures apparently such a thing is possible in the yara python library. if anyone has done this before please let me know

[pielco11]

@Evan-Sa quicksand_lite is written is C, that could be not so easy to play with. Maybe using the compiled version and parse the output from quicksand to ssma. Plus quicksand drops embedded exes and objects, also these dropped elements could be analyzed with ssma for a deeper and more complete scan, imho.

The best thing to do would be creating a python lib for quicksand, but this will require lot of time and not basic knowledge.

[secrary]

Guys, you are doing great job, but I'm sorry, don't have a time to help :(
I've add you to Collaborators

[Evan-Sa]

@pielco11 I downloaded your fork I found it pretty helpful. I would like to the see the same output in ssma when you sue the document flag. I am looking into a detailed display for the matching strings in yara signatures apparently such a thing is possible in the yara python library. if anyone has done this before please let me know