NSM - Malware Archive - Decompressing Export Files

[Former Member]

Hi,

Under maintenance within NSM there is a Malware Archive section, here you can export a cached malware file under the format of "HASH.mcafee".

Is there anyway to recover the original file from this?

I'm interested in running the originals through sandbox products like DeepViz and Hybrid Analysis but can't see to retrieve the original or convert the file into any acceptable format.

Some sandbox files will capture files you can download and run independently to determine their reputation/contents.

Usually you get a file that you need to rename to a .zip format, from there you can uncompress it and rename the files inside to their original extensions and you now have the original file.

Is this possible with the .mcafee files?

Thanks,

[petermason · Accepted solution]

Hi James,

There is a tool called MalwareDecrypter.bat on the manager in the \app\diag\malwareUtil folder that you use to un-encrypt these files.

Details of how to use it are on P214 of the NSP_82_Manager_Administration_Guide_revJ_en-us document available here;

Network Security Platform documentation reference guide

https://kc.mcafee.com/agent/index?page=content&id=KB76064

Regards

Peter

[Former Member]

Hi Peter,

I used the MalwareDecypter.bat tool to un-encrypt the archived malware, but I only see the tmp folder is created, not anything be found. Pls support me.

[petermason]

Hi James,

What version of the NSP software are you running?

When you run the MalwareDecrypter.bat utility is it giving you a message to say it was successful?

What if the full command you are running?

Regards

Peter

[Former Member]

Hi Peter,

I running the NSP version 8.2.7.83

Below is the result after I enter command. I tried use <file name>.mcafee or <file name> only, but the result is the same

[petermason]

Hi Stonewall

You need to use the File Type and File Hash that you see in the manager, not the actual name of the archive file.

Examples from the Admin guide

The utility tool can be run using one of the following combinations of commands and parameters:

• To decrypt a specific file: MalwareDecrypter.bat "FILE_TYPE" FILE_HASH

Example: MalwareDecrypter.bat "PDF Files" 01234567890123456789012345678901

• To decrypt all files of a specific file type: MalwareDecrypter.bat "FILE_TYPE"

Example: MalwareDecrypter.bat "PDF Files"

• To decrypt all files: MalwareDecrypter.bat *

The decrypted malware file is stored in the aforementioned location (C:\Program Files\McAfee\Network Security Manager\App\temp\tftpin\malware\tmp) in a folder named after the family classification of the file type and not the file type name itself.

[Former Member]

Hi Peter,

Your explanation is very helpful. Thanks so much.

I have one more question. My customer separately build the Operator team and Security team. The security team only permitted access to Web GUI. That mean, to analyze malware, They must be approlved RDP to NSM server, right? Could you share me your recommendation.

[petermason]

Hi Stonewall,

You could share the folder containing the malware archives on the server and just give them permissions to read the files directly from that folder, they could just connect using a UNC path.

Regards

Peter

[Former Member]

Hi Peter

Apologize for my inconvenience. The malware archives encrypted they must be decrypted manually on NSM server before analyze. Who will do it? The Sec team can't do it on a UNC path. If it is Operator team, they aren't available 24/7 to process the request from Sec team. Sorry if my think is wrong.

[petermason]

Hi Stonewall,

You could try writing a script to run the MalwareDecrypter.bat utility periodically to uncompress the files. Then they could be copied by the Security Team from the server.

You could also try to use the MalwareDecrypter.bat tool on a standalone machine to decompress the files, I don't know if it has any dependencies but you could contact McAfee Support if you have questions.