reversing 2020 yara summit pushing the barriers of unique
play

Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA - PowerPoint PPT Presentation

Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 1 TLP-GREEN TOM UELTSCHI YARA-SUMMIT 2020 C:> whoami /all Tom Ueltschi Swiss Post CERT / SOC / CSIRT since 2007 (13 years!) Focus


  1. Outline • Introduction • Automate malware analysis (how far can you go?) • Using YARA on “uncommon” or “unusual” file types • PCAP files • memory-strings & mutexes • JAR’s (Java RAT’s) • “DESKTOP-group” -- Spear Phishing emails & mail headers • YARA for email headers and body • Weird file formats: MSI + JAR || RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 34

  2. Using YARA on “uncommon” or “unusual” file types Java RATs and JAR files Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 35

  3. Using YARA on “uncommon” or “unusual” file types Java RATs and JAR files Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 36

  4. Using YARA on “uncommon” or “unusual” file types Java RATs and JAR files Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 37

  5. Using YARA on “uncommon” or “unusual” file types Java RATs and JAR files Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 38

  6. Using YARA on “uncommon” or “unusual” file types Java RATs and JAR files Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 39

  7. Using YARA on “uncommon” or “unusual” file types Java RATs and JAR files Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 40

  8. Outline • Introduction • Automate malware analysis (how far can you go?) • Using YARA on “uncommon” or “unusual” file types • PCAP files • memory-strings & mutexes • JAR’s (Java RAT’s) • “DESKTOP-group” -- Spear Phishing emails & mail headers • YARA for email headers and body • Weird file formats: MSI + JAR || RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 41

  9. First Hand Knowledge Analyzing mail headers • Date • From (display-name / email) • Subject • Attachment(s) – Filename(s) / MD5 hash(es) à Malware Analysis • Message-ID à Malware / RAT Family • X-Mailer / User-Agent à C2 domain / IP / port • X-Source-Auth / X-Sender / Authenticated-Sender • X-Source-IP / X-Originating-IP • Received headers à Client IP Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 42

  10. First Hand Knowledge Analyzing mail headers à Excel with >140 attack mails Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 43

  11. Message-ID / DESKTOP-name / X-Mailer Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 44

  12. Received header hostname = Message-ID host Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 45

  13. Received hostname ( WIN-xxx ß DESKTOP-xxx ) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 46

  14. Message-ID / (9) Desktop-/ (2) Server-names Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 47

  15. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on any header Message-ID header Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 48

  16. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on any header Received headers Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 49

  17. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on any header From header X- / Auth.-Sender Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 50

  18. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on body URLs URLs in body (base64) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 51

  19. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on body URLs URLs in body (base64) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 52

  20. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on body URLs URLs in body (base64) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 53

  21. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on body URLs URLs in body (base64) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 54

  22. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on any header Blocked only due to custom YARA rule Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 55

  23. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on any header Blocked only due to custom YARA rule Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 56

  24. Outline • Introduction • Automate malware analysis (how far can you go?) • Using YARA on “uncommon” or “unusual” file types • PCAP files • memory-strings & mutexes • JAR’s (Java RAT’s) • “DESKTOP-group” -- Spear Phishing emails & mail headers • YARA for email headers and body • Weird file formats: MSI + JAR || RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 57

  25. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 58

  26. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 59

  27. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 60

  28. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 61

  29. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 62

  30. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 63

  31. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 64

  32. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 65

  33. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 66

  34. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 67

  35. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 68

  36. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 69

  37. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 70

  38. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 71

  39. Outline • Introduction • Automate malware analysis (how far can you go?) • Using YARA on “uncommon” or “unusual” file types • PCAP files • memory-strings & mutexes • JAR’s (Java RAT’s) • “DESKTOP-group” -- Spear Phishing emails & mail headers • YARA for email headers and body • Weird file formats: MSI + JAR || RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 72

  40. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 73

  41. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 74

  42. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 75

  43. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS 7 x EXCEL.EXE 7 x PS cmd (1) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 76

  44. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS 1 x PS cmd (2) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 77

  45. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 78

  46. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 79

  47. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 80

  48. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Pow-er-sh-ell Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 81

  49. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 82

  50. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 83

  51. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 84

  52. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 85

  53. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 86

  54. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 87

  55. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 88

  56. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 89

  57. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Office files Last saved / author Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 90

  58. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS (Hunting @ home) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 91

  59. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS (Hunting @ home) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 92

  60. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS (Hunting @ home) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 93

  61. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR || RTF + XLS (Hunting @ VT) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 94

  62. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR || RTF + XLS (Hunting @ VT) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 95

  63. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR || RTF + XLS (Hunting @ VT) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 96

  64. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR || RTF + XLS (Hunting @ RL) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 97

  65. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR || RTF + XLS (Hunting @ RL) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 98

  66. Outline • Introduction • Automate malware analysis (how far can you go?) • Using YARA on “uncommon” or “unusual” file types • PCAP files • memory-strings & mutexes • JAR’s (Java RAT’s) • “DESKTOP-group” -- Spear Phishing emails & mail headers • YARA for email headers and body • Weird file formats: MSI + JAR || RTF + XLS (Hunting @ home / VT / RL) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 99

  67. Thanks for your attention!! Time left for questions? • Twitter: @c_APT_ure • Blog: http://c-apt-ure.blogspot.com/ à all my presentations linked in one place Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 100

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend