None. There is no network activity in particular.

Nothing particularly malicious (refer to Cuckoo sandboxes reports).

There are six malware samples in the pack collected from Contagio dump, so you can try to write static as well as generic signatures after analyzing each of the malware samples. As a preliminary countermeasure, doing this in Yara is a breeze with its myriad options to combine text and hex strings. After writing the following signature, you can run Yara as:

yara –r <signature file.yar> <path to malware folder>

This detects all the samples in the pack (sans the dropper, which is a separate executable):

The –r switch is for the recursive search mode and ds.yar.txt is the signature text file, and is shown in the preceding exhibit:

The various parts of the Yara signature are the meta section containing metadata or the unprocessed text that are name value pairs used to annotate the signature and provide additional information to the user. The strings section is where you write textual and hex-based markers as a database of rules, and this is not mandatory if you feel that strings are not needed. The condition section is where the Boolean conditions are implemented taking the data available in the strings section to validate a positive detection.

The $OEP identifier uses wild cards and jumps to accommodate byte level differences in the executable entrypoint code from sample to sample. In the other identifiers, the fullword modifier is used to enable the whole string to be used as a unit or separate word.

You will find that other parameters from the PE headers could also be taken. Timestamp ranges are repetitive in the binary. The file size meanders around 24,000 bytes mark with repeating numbers. Various code sections can be wild carded and jump effected to wrap the whole collection, especially the hashing functions and the payload parts. This can be a good exercise for you to enjoy undertaking.

Finally, while the bulk of the malware has been analyzed, be on the lookout for additional unreachable code regions that might be templates for future variants and double-check the percent of code real estate you have covered. While this will ostensibly take a lot more resources from your end and is very much a trial and error method, you can ideally build a whiltelist (the majority of the AV vendors have this) of legitimate applications and run your generic signatures on them to flag any false positives. This step will help tune your signatures to mark only the malicious code. Just for the sake of interest as to the impact of false positives, you can search the Internet for news related to AV vendors and some of the case stories of how customers had to deal with files getting deleted off their machines because the AV product thinks it is malicious, and the repercussions. Signature testing is a serious business inside an antivirus company as the stakes are high and it can take many hours or even a day or two before they get "released" internally toward the final build, with lots of staged checks and automated testing using machine learning algorithms. The signatures themselves are compiled to the proprietary binary format of the vendor to speed up performance and to prevent IP theft and reversing of the sig-database. All in all, make judicious use of IDA Pro's FLIRT technology and comment out all analyzed code in the IDB database. You could also leverage power tools such as Zynamics Bindiff and BinNavi to do more in-depth analyses if so required and if time permits. The code regions in focus can then be further analyzed to provide conjecture that may be of use in the times ahead. However, remind yourself of the point of diminishing returns to the amount of continued effort needed and know when to call it a day, especially when time is a priced commodity and the major scoops are taken!

Another good habit for a malware analyst to uphold is to take regular backups of your analysis sessions—all samples, notes, screenshots, video recordings, and memory dumps can be collected in a master folder, named after the malware and its hash, annotated and selectively included within Scrivener. If permitting, you should take online cloud backups of all analysis assets for safe storage. This is purely for personal insurance and posterity.