Comparing Malicious Files RVAsec May 22, 2019 Problem Statements - - PowerPoint PPT Presentation

▶
comparing malicious files
SMART_READER_LITE
LIVE PREVIEW

Comparing Malicious Files RVAsec May 22, 2019 Problem Statements - - PowerPoint PPT Presentation

Oct 08, 2023 222 likes •1.11k views

Comparing Malicious Files RVAsec May 22, 2019 Problem Statements AV Problem Many AV companies use their own unique nomenclature for malware and malware families @MalwareUtkonos Marketing Problem Marketing departments want to brand the

slide-1
SLIDE 1

Comparing Malicious Files

RVAsec May 22, 2019

slide-2
SLIDE 2

Problem Statements

slide-3
SLIDE 3

AV Problem

Many AV companies use their own unique nomenclature for malware and malware families

@MalwareUtkonos

slide-4
SLIDE 4

Marketing Problem

Marketing departments want to brand the malware families that their company has identified

🐽 🚁 🐲 🚁 🐼 🐽 🐼 🐲

@MalwareUtkonos

slide-5
SLIDE 5

WTF??????

  • APT28
  • Pawn Storm
  • Fancy Bear
  • Sednit
  • TsarTeam
  • TG-4127
  • Group-4127
  • STRONTIUM
  • TAG_0700
  • Swallowtail
  • IRON TWILIGHT
  • Group 74

@MalwareUtkonos

slide-6
SLIDE 6

Missing Criteria

@MalwareUtkonos

slide-7
SLIDE 7

Researcher’s Problem

What am I looking at? Can I relate this to other samples that have already been identified? Is this a new attack?

@MalwareUtkonos

slide-8
SLIDE 8

Incident Responder’s Problem

What is this related to? Can I locate previous work around this malware, so I can save time?

@MalwareUtkonos

slide-9
SLIDE 9

Solution Methods

slide-10
SLIDE 10

Sample Identification

Determine malware family membership of sample

@MalwareUtkonos

slide-11
SLIDE 11

Locating Associated Samples

Within a set of samples, which are related?

@MalwareUtkonos

slide-12
SLIDE 12

Identification Method: Anti-Virus Scanner Results

slide-13
SLIDE 13

Shared Engines

Sample: 68119dd7fb9ecb099de50227162bd82f Scanner Result: Trojan.GenericKD.40437487 AV Companies: Ad-Aware, ALYac, BitDefender, Emsisoft, F-Secure, GData, MicroWorld-eScan

@MalwareUtkonos

slide-14
SLIDE 14

Development Methods

Generic Specific

http://www.beerdestroyer.com/wp-content/uploads/2013/05/dc_brau_corruption.jpg http://who-really-cares-anyway.blogspot.com/2007/03/generic-food.html

@MalwareUtkonos

slide-15
SLIDE 15

Vendors with Usable Results

Microsoft ESET Kaspersky Sophos

https://www.microsoft.com/en-us/wdsi/threats http://www.virusradar.com/en/threat_encyclopaedia https://encyclopedia.kaspersky.com https://www.sophos.com/en-us/threat-center/threat-analyses /viruses-and-spyware.aspx

@MalwareUtkonos

slide-16
SLIDE 16

Boiling Down Results

Sample: c3f9d80d11ab3671cd412e94de4141ad

@MalwareUtkonos

slide-17
SLIDE 17

Boiling Down Results

Remove clearly generic results Watch for sneaky generic results: Zeus, Zbot, Zusy, etc.

@MalwareUtkonos

slide-18
SLIDE 18

Boiling Down Results

ESET-NOD32 Win32/Adware.VrBrot Yandex Trojan.DR.PeBundle.A McAfee Artemis!C3F9D80D11AB VBA32 Trojan.Isbar Ad-Aware Gen:Variant.Symmi.89546 DrWeb Trojan.Isbar.863 ALYac Gen:Variant.Symmi.89546 Arcabit Trojan.Symmi.D15DCA BitDefender Gen:Variant.Symmi.89546 NANO-Antivirus Trojan.Win32.Isbar.fhgjim F-Secure Gen:Variant.Symmi.89546 ViRobot Trojan.Win32.Z.Symmi.954946 MicroWorld-eScan Gen:Variant.Symmi.89546 Avast Win32:VrBrothers-A [Adw] Emsisoft Gen:Variant.Symmi.89546 (B) AVG Win32:VrBrothers-A [Adw] Ikarus Trojan-Spy.Win32.Sincom GData Win32.Backdoor.Hupigon.B Microsoft Trojan:Win32/Occamy.C Kingsoft Win32.RiskWare.PEBundle.49152

@MalwareUtkonos

slide-19
SLIDE 19

Boiling Down Results

ESET-NOD32 Win32/Adware.VrBrot Yandex Trojan.DR.PeBundle.A McAfee Artemis!C3F9D80D11AB VBA32 Trojan.Isbar Ad-Aware Gen:Variant.Symmi.89546 DrWeb Trojan.Isbar.863 ALYac Gen:Variant.Symmi.89546 Arcabit Trojan.Symmi.D15DCA BitDefender Gen:Variant.Symmi.89546 NANO-Antivirus Trojan.Win32.Isbar.fhgjim F-Secure Gen:Variant.Symmi.89546 ViRobot Trojan.Win32.Z.Symmi.954946 MicroWorld-eScan Gen:Variant.Symmi.89546 Avast Win32:VrBrothers-A [Adw] Emsisoft Gen:Variant.Symmi.89546 (B) AVG Win32:VrBrothers-A [Adw] Ikarus Trojan-Spy.Win32.Sincom GData Win32.Backdoor.Hupigon.B Microsoft Trojan:Win32/Occamy.C Kingsoft Win32.RiskWare.PEBundle.49152

@MalwareUtkonos

slide-20
SLIDE 20

Boiling Down Results

ESET-NOD32 Win32/Adware.VrBrot Yandex Trojan.DR.PeBundle.A McAfee Artemis!C3F9D80D11AB VBA32 Trojan.Isbar Ad-Aware Gen:Variant.Symmi.89546 DrWeb Trojan.Isbar.863 ALYac Gen:Variant.Symmi.89546 Arcabit Trojan.Symmi.D15DCA BitDefender Gen:Variant.Symmi.89546 NANO-Antivirus Trojan.Win32.Isbar.fhgjim F-Secure Gen:Variant.Symmi.89546 ViRobot Trojan.Win32.Z.Symmi.954946 MicroWorld-eScan Gen:Variant.Symmi.89546 Avast Win32:VrBrothers-A [Adw] Emsisoft Gen:Variant.Symmi.89546 (B) AVG Win32:VrBrothers-A [Adw] Ikarus Trojan-Spy.Win32.Sincom GData Win32.Backdoor.Hupigon.B Microsoft Trojan:Win32/Occamy.C Kingsoft Win32.RiskWare.PEBundle.49152

@MalwareUtkonos

slide-21
SLIDE 21

Boiling Down Results

Ad-Aware Gen:Variant.Symmi.89546 VBA32 Trojan.Isbar Arcabit Trojan.Symmi.D15DCA DrWeb Trojan.Isbar.863 ViRobot Trojan.Win32.Z.Symmi.954946 NANO-Antivirus Trojan.Win32.Isbar.fhgjim

Win32.Trojan.Symmi Win32.Trojan.Isbar

@MalwareUtkonos

slide-22
SLIDE 22

Boiling Down Results

Ad-Aware Gen:Variant.Symmi.89546 VBA32 Trojan.Isbar Arcabit Trojan.Symmi.D15DCA DrWeb Trojan.Isbar.863 ViRobot Trojan.Win32.Z.Symmi.954946 NANO-Antivirus Trojan.Win32.Isbar.fhgjim

Win32.Trojan.Symmi Win32.Trojan.Isbar

@MalwareUtkonos

slide-23
SLIDE 23

Boiling Down Results

Ad-Aware Gen:Variant.Symmi.89546 VBA32 Trojan.Isbar Arcabit Trojan.Symmi.D15DCA DrWeb Trojan.Isbar.863 ViRobot Trojan.Win32.Z.Symmi.954946 NANO-Antivirus Trojan.Win32.Isbar.fhgjim

Win32.Trojan.Symmi Win32.Trojan.Isbar

@MalwareUtkonos

slide-24
SLIDE 24

Automation: AVClass

  • Family Rankings
  • PUP Classification
  • Ground Truth Evaluation
  • Generic Token Detection
  • Alias Detection

@MalwareUtkonos

https://github.com/malicialab/avclass

slide-25
SLIDE 25

Identification Method: MITRE ATT&CK

slide-26
SLIDE 26

ATT&CK

  • Framework for categorization of

adversary tactics and techniques

  • Excellent first step
  • Not yet ready for malware classification
  • There is a better option!

@MalwareUtkonos

slide-27
SLIDE 27

ATT&CK & Granularity

@MalwareUtkonos

https://steemit.com/reverseengineering/@utkonos/alphablend-campaign-part-2

slide-28
SLIDE 28

ATT&CK & Granularity

@MalwareUtkonos

slide-29
SLIDE 29

SEH Variation

@MalwareUtkonos

slide-30
SLIDE 30

Contribute Sub-Techniques

https://attack.mitre.org/resources/contribute/

@MalwareUtkonos

slide-31
SLIDE 31

2FA Interception (T1111)

  • SMS interception on the wire (SORM)
  • SMS interception by number porting
  • Code interception via phishing page (Nile

Phish, Charming Kitten)

  • Keylogger

@MalwareUtkonos

slide-32
SLIDE 32

Better System

slide-33
SLIDE 33

The New MAEC

@MalwareUtkonos

Anti-Behavioral Analysis Execution Anti-Static Analysis Exfiltration Collection Impact Command and Control Lateral Movement Credential Access Persistence Defense Evasion Privilege Escalation Discovery

https://github.com/MAECProject/malware-behaviors

slide-34
SLIDE 34

Identification Method: Malpedia

slide-35
SLIDE 35

Malpedia: FIN7, Carbanak

https://malpedia.caad.fkie.fraunhofer.de/actor/anunak

@MalwareUtkonos

slide-36
SLIDE 36

Malpedia Results

@MalwareUtkonos

slide-37
SLIDE 37

Contribute!!!!!

@MalwareUtkonos

slide-38
SLIDE 38

Identification Method: Google

slide-39
SLIDE 39

https://xkcd.com/627/

@MalwareUtkonos

slide-40
SLIDE 40

https://xkcd.com/627/

@MalwareUtkonos

slide-41
SLIDE 41

Proposal

slide-42
SLIDE 42

Proposal

slide-43
SLIDE 43

Association Method: Static Analysis

slide-44
SLIDE 44

Some Hashes

ssdeep: Context triggered piecewise hash Import Hash (imphash): Calculated from PE file import table

@MalwareUtkonos

slide-45
SLIDE 45

Exif Metadata

@MalwareUtkonos

slide-46
SLIDE 46

Code Signing Certificate

Signed by fake cert Signed by real/stolen cert Signed-ish: broken signature

@MalwareUtkonos

slide-47
SLIDE 47

Abused Certificates

@MalwareUtkonos

slide-48
SLIDE 48

PE Metadata

Sections Imports / Exports Resources

@MalwareUtkonos

slide-49
SLIDE 49

@MalwareUtkonos

slide-50
SLIDE 50

Sections

Sample: 0a9545f9fc7a6d8596cf07a59f400fd3 Name: .reloc MD5: 3a64e2292f5eb1bbe70428c1c6ee22d5

@MalwareUtkonos

slide-51
SLIDE 51

Sections

Sample: 0a9545f9fc7a6d8596cf07a59f400fd3 Name: .reloc MD5: 3a64e2292f5eb1bbe70428c1c6ee22d5

@MalwareUtkonos

slide-52
SLIDE 52

Resources

Sample: c7577748e6e7c71cdf5a950655b2456e Name: RT_VERSION SHA256: 4df4bf2f6de1beb10586f49b4155fffb946279e8b0 a69d6fbbe695158bbb63ae

@MalwareUtkonos

slide-53
SLIDE 53

ReversingLabs Hash Algorithm

https://www.reversinglabs.com/technology/ reversinglabs-hash-algorithm.html

@MalwareUtkonos

slide-54
SLIDE 54

VirusTotal similar-to:

Proprietary black magic, but very effective

@MalwareUtkonos

slide-55
SLIDE 55

Document Metadata

Author Timestamps Language PDF Producer

@MalwareUtkonos

slide-56
SLIDE 56

Association Method: Dynamic Analysis

slide-57
SLIDE 57

Filenames

Boring: finding exactly the same filename More exciting: develop regex for a pattern of generated filenames.

@MalwareUtkonos

slide-58
SLIDE 58

URL Structure: Download

Related to the vulnerability in the CMS that was exploited to create the URL

@MalwareUtkonos

slide-59
SLIDE 59

URL Structure: Download

Example:

http://terumoindonesia.com/wp-content/themes/twentysixteen/

Regex:

wp-[a-z]+/themes/twenty(?:ten|eleven|twelve|thirteen|fourteen|fifteen|sixteen|seventeen|eighteen)

@MalwareUtkonos

slide-60
SLIDE 60

URL Structure: C2

Directly related to the malware family

@MalwareUtkonos

slide-61
SLIDE 61

URL Structure: C2

Example: http://dinttobogo.com/zapoy/gate.php

@MalwareUtkonos

slide-62
SLIDE 62

Mutual Exclusion (Mutex)

Prevents race conditions with multiple processes and multiple threads.

https://en.wikipedia.org/wiki/Mutual_exclusion

@MalwareUtkonos

slide-63
SLIDE 63

Registry Key

Hierarchical database for low-level OS and application settings.

https://en.wikipedia.org/wiki/Windows_Registry

@MalwareUtkonos

slide-64
SLIDE 64

Association Method: Clustering Algorithms

slide-65
SLIDE 65

Standing on Shoulders of Giants

“Python and Machine Learning: How to clusterize a malware dataset?” https://github.com/sebdraven/hack_lu_2017 And botconf!

@MalwareUtkonos

slide-66
SLIDE 66

Algorithms

K-Means DBScan

@MalwareUtkonos

slide-67
SLIDE 67

https://thescinder.files.wordpress.com/2017/06/goingtoneedagpuimgflip1.jpg

@MalwareUtkonos

slide-68
SLIDE 68

Association Method: Diamond Model of Intrusion Analysis

slide-69
SLIDE 69

@MalwareUtkonos

slide-70
SLIDE 70

Diamond Model

http://www.dtic.mil/docs/citations/ADA586960

@MalwareUtkonos

slide-71
SLIDE 71

Association Method: Icewater

slide-72
SLIDE 72

Icewater

http://icewater.io/search

@MalwareUtkonos

slide-73
SLIDE 73

@MalwareUtkonos

slide-74
SLIDE 74

@MalwareUtkonos

slide-75
SLIDE 75

Association Method: Control Flow Graph Analysis

slide-76
SLIDE 76

Control Flow Graph Analysis

Control Flow Graph Based Virus Scanning (DerbyCon 2014) Douglas Goddard https://www.youtube.com/watch?v=I0KXjN67hkA

@MalwareUtkonos

slide-77
SLIDE 77

https://rada.re/r/img/webui-graph.png

@MalwareUtkonos

slide-78
SLIDE 78

Analysis Technique: Graphing Threat Data

slide-79
SLIDE 79

Schema: STIX

@MalwareUtkonos Attack Pattern Indicator Malware Campaign Intrusion Set Observed Data Course of Action Tool Report Identity Vulnerability Threat Actor

STIX Domain Objects (SDO)

Relationship Sighting

STIX Relationship Objects (SRO)

slide-80
SLIDE 80

Schema: STIX

@MalwareUtkonos

https://oasis-open.github.io/cti-documentation/stix/intro

slide-81
SLIDE 81

Graph Tools: Data Formats

@MalwareUtkonos

  • Resource Description Framework (RDF)

○ https://www.w3.org/RDF/

  • JSON for Linking Data

○ https://json-ld.org/

slide-82
SLIDE 82

JSON for Linking Data: JSON-LD

@MalwareUtkonos

slide-83
SLIDE 83

RDF N-Quad

@MalwareUtkonos

slide-84
SLIDE 84

Graph Tools: Graph Databases

@MalwareUtkonos

  • Neo4j

○ https://neo4j.com/

  • DGraph

○ https://dgraph.io/

slide-85
SLIDE 85

Book

@MalwareUtkonos

Introduction to Graph Theory Richard J. Trudeau

slide-86
SLIDE 86

Network Graph

@MalwareUtkonos

slide-87
SLIDE 87

Network Graph

@MalwareUtkonos

slide-88
SLIDE 88

Questions?

@MalwareUtkonos