Visiting the snake nest Recon Brussels 2018 Jean-Ian Boutin | - - PowerPoint PPT Presentation

▶
visiting the snake nest
SMART_READER_LITE
LIVE PREVIEW

Visiting the snake nest Recon Brussels 2018 Jean-Ian Boutin | - - PowerPoint PPT Presentation

Jul 14, 2023 647 likes •2.05k views

Visiting the snake nest Recon Brussels 2018 Jean-Ian Boutin | Senior Malware Researcher Matthieu Faou | Malware Researcher Jean-Ian Boutin Matthieu Faou Senior Malware Researcher Malware Researcher @jiboutin @matthieu_faou Agenda 1.

slide-1
SLIDE 1

Visiting the snake nest

Recon Brussels 2018

Jean-Ian Boutin | Senior Malware Researcher Matthieu Faou | Malware Researcher

slide-2
SLIDE 2

Jean-Ian Boutin

Senior Malware Researcher

Matthieu Faou

Malware Researcher @jiboutin @matthieu_faou

slide-3
SLIDE 3

Agenda

  • 1. Introduction
  • 2. Infection Vectors
  • 3. First Stages
  • 4. Advanced First Stages
  • 5. Second Stages
  • 6. Infrastructure
  • 7. Conclusion
slide-4
SLIDE 4

Introduction

slide-5
SLIDE 5
slide-6
SLIDE 6
slide-7
SLIDE 7
slide-8
SLIDE 8
slide-9
SLIDE 9

Is ESET doing attribution?

slide-10
SLIDE 10

Turla in short

  • One of the oldest espionage group
  • Targets includes governments, government
  • fficials, diplomats, …
  • Very large toolset targeting all major platforms
slide-11
SLIDE 11

Infection Vectors

slide-12
SLIDE 12

Overview

  • Wateringhole
  • Spearphishing
slide-13
SLIDE 13

Watering Hole

  • Planting scripts in targets’ favs websites

URL (past campaigns) Notes http://www.namibianembassyusa.org Namibia Embassy - USA http://www.avsa.org African Violet Societa of America http://www.zambiaembassy.org Zambian Embassy - USA http://russianembassy.org Russian Embassy - USA http://au.int African Union http://mfa.gov.kg Ministry of Foreign Affairs – Kyrgyzstan http://mfa.uz Ministry of Foreign Affairs - Uzbekistan

slide-14
SLIDE 14

Script Injection

1st level C&C mentalhealthcheck.net drivers.epsoncorp.com rss.nbcpost.com static.travelclothes.org msgcollection.com

slide-15
SLIDE 15

Script Injection

1st level C&C mentalhealthcheck.net drivers.epsoncorp.com rss.nbcpost.com static.travelclothes.org msgcollection.com

slide-16
SLIDE 16

Script Injection

1st level C&C mentalhealthcheck.net drivers.epsoncorp.com rss.nbcpost.com static.travelclothes.org msgcollection.com

slide-17
SLIDE 17

PluginDetect

  • Fingerprinting potential target through JS
slide-18
SLIDE 18

Browser Extension

slide-19
SLIDE 19

C&C fetching

  • Computes comments

checksum

  • Regular expression applied

'(?:\\u200d)(?:#|@)?(\\w)'

  • https://bitly.com/2kdhuHX
slide-20
SLIDE 20

C&C fetching

  • Computes comments

checksum

  • Regular expression applied

'(?:\\u200d)(?:#|@)?(\\w)'

  • https://bitly.com/2kdhuHX
slide-21
SLIDE 21
  • A bit disappointing

that this one was not used…

slide-22
SLIDE 22
slide-23
SLIDE 23

Mosquito

slide-24
SLIDE 24

Overview

  • Campaign running since at least July 2016
  • Infection vector is a fake flash installer
  • Downloaded from http://admdownload.adobe.com *
  • Use either a Win32 or a JScript backdoor

* We believe Adobe was not compromised

slide-25
SLIDE 25

Tracing the infection chain

slide-26
SLIDE 26

Something weird is happening on the network

slide-27
SLIDE 27

Possible interception points

slide-28
SLIDE 28

During the installation…

http://get.adobe.com/stats/AbfFcBebD/q=<base64-encoded data>

slide-29
SLIDE 29

Information exfiltrated to get.adobe.com over HTTP

slide-30
SLIDE 30
slide-31
SLIDE 31

OSX/Snake

slide-32
SLIDE 32

OSX/Snake

slide-33
SLIDE 33

It even tricked researchers!

slide-34
SLIDE 34

1st Stages

slide-35
SLIDE 35

Many have been documented

  • Culex
  • Tavdig
  • Skipper
  • Kopiluwak
  • …
slide-36
SLIDE 36

Tavdig/ Wipbot

slide-37
SLIDE 37

Tavdig

  • (Older) backdoor used to assess target usefulness
  • Can execute command, modify backdoor

configuration, download additional files, etc

  • Dropped through watering hole or spearphishing

(old PDF CVE and macros)

slide-38
SLIDE 38

Overall Architecture

  • Used for
  • System fingerprinting
  • OS version
  • Computer name
  • Current user name
  • Local groups
  • System directory
  • System language, user language, timezone, uptime, etc
  • Backdoor (upload/download file, execute, etc)
slide-39
SLIDE 39

Different Versions

  • Observations based on samples analyzed

Version Sample sightings Differences A October 2013 – February 2014

  • N/A

B April 2014 – July 2014

  • Introduction of macro based Word dropper
  • Introduction of the two steps injection
  • Introduction of shell_traywnd injection trick

C September 2015 – November 2015

  • Introduction of code obfuscation through “this” pointer
  • Introduction of list of injectable processes instead of just

iexplore.exe

slide-40
SLIDE 40

Version C process list

  • Hash-based process name search
  • Crackable through John the Ripper

icq.exe msimn.exe

  • pera.exe

chrome.exe pidgin.exe firefox.exe

  • utlook.exe

iexplore.exe jusched.exe browser.exe icqlite.exe adobearm.exe adobeupdater.exe

slide-41
SLIDE 41

Tavdig word attachment

  • Malicious macro embedded

in document

  • Macro decrypts payload and

launches it

slide-42
SLIDE 42

Tavdig word attachment

  • Malicious macro embedded

in document

  • Macro decrypts payload and

launches it File size

slide-43
SLIDE 43

Tavdig word attachment

  • Malicious macro embedded

in document

  • Macro decrypts payload and

launches it Checksum

slide-44
SLIDE 44

Skipper

slide-45
SLIDE 45

Skipper

  • Minimal backdoor used against governmental

and diplomatic institutions since at least 2014

  • Can execute commands, ex-filtrate files and

download additional malware

  • Delivered in malicious macros, JS attachments
slide-46
SLIDE 46

Skipper vs. Tavdig

slide-47
SLIDE 47

Skipper vs. Tavdig

slide-48
SLIDE 48

Skipper vs. Tavdig

slide-49
SLIDE 49

Skipper Development

  • C:\Users\admin\Documents\Visual Studio

2012\Projects\dws\x64\Release\ GetPidByProcessName_x64.pdb

  • C:\Users\work4\Documents\Visual Studio

2012\Projects\KOTEL 24.11.16 No COOKIE No STORAGE only BODY\KOTEL_2.1\x64\Release\ GetPidByProcessName_x64.pdb

slide-50
SLIDE 50

Skipper Development

  • C:\Users\admin\Documents\Visual Studio

2012\Projects\dws\x64\Release\ GetPidByProcessName_x64.pdb

  • C:\Users\work4\Documents\Visual Studio

2012\Projects\KOTEL 24.11.16 No COOKIE No STORAGE only BODY\KOTEL_2.1\x64\Release\ GetPidByProcessName_x64.pdb

slide-51
SLIDE 51

Skipper email attachment

  • SECTION_INTERNET-

NOTICE_TO_ALL_USERS_13-05-2016.pdf.js

slide-52
SLIDE 52

WinRAR archive content Loader Process Injection C&C Comm

slide-53
SLIDE 53

Skipper Misc

  • Implements a bunch of anti-emulation tricks
slide-54
SLIDE 54

Skipper Misc

  • Implements a bunch of anti-emulation tricks
slide-55
SLIDE 55

Skipper Misc

  • Implements a bunch of anti-emulation tricks
slide-56
SLIDE 56

Skipper Misc

  • Implements a bunch of anti-emulation tricks
slide-57
SLIDE 57

Skipper Misc

  • Implements a bunch of anti-emulation tricks
slide-58
SLIDE 58
slide-59
SLIDE 59

Misc – OPSEC failure

  • Operators use Vim!!
  • https://[C&C server]/rss.php~
slide-60
SLIDE 60

Advanced 1st stages

Image credit: SpaceX

slide-61
SLIDE 61

Mosquito

slide-62
SLIDE 62

Win32 Mosquito

  • 1st or 2nd stage (Skipper)
  • Deployed in Eastern Europe on diplomats’

machines

  • Uses a custom packer
slide-63
SLIDE 63

Packer – Opaque predicates

slide-64
SLIDE 64

Packer – Anti-sandbox/emulation

  • Call to SetupDiGetClassDevs(0,0,0,0xFFFFFFFF)
  • Last parameter value is undocumented
  • Expect 0xE000021A as return value
slide-65
SLIDE 65

Components

slide-66
SLIDE 66

Components

Backdoor

slide-67
SLIDE 67

Components

Backdoor Loader

slide-68
SLIDE 68

Components

Backdoor Loader Encrypted log file

slide-69
SLIDE 69

Persistence 1/2

  • CLSID hijacking
  • Ex: Ntshrui.dll
slide-70
SLIDE 70

Persistence 2/2

  • Create a new admin account: HelpAssistant
  • Enable remote administrative actions for this user
  • Maybe used to spy or regain control if the backdoor is

deleted.

slide-71
SLIDE 71

Where are you export table?

slide-72
SLIDE 72

Export table patching

slide-73
SLIDE 73

I’m here!

slide-74
SLIDE 74

Encryption

  • Data is xored with a generated key
  • No, I won’t show you the xor loop :D
  • Generation algorithm looks like BlumBlumShub
  • Takes a key and a modulo to generate a bytes stream
slide-75
SLIDE 75

Network communications

  • C&C
  • HTTPs
  • URI: /scripts/m/query.php?id=<base64 data>
  • SATCOM IP addresses and Cloudflare
slide-76
SLIDE 76

Network communications

  • C&C
  • HTTPs
  • URI: /scripts/m/query.php?id=<base64 data>
  • SATCOM IP addresses and Cloudflare
  • Encrypted data in:
  • GET parameter (id)
  • Cookie
  • POST
slide-77
SLIDE 77

Backdoor functions

  • Download & execute additional files
  • Launch a process
  • Delete a file
  • Exfiltrate a file
  • Add/Delete a C&C server
slide-78
SLIDE 78

Mosquito vs ComRAT

  • Encryption algorithms are different
  • Log structures are different
  • Both use CLSID hijacking
  • Overlap in the network infrastructure
  • Some similarities in the code
slide-79
SLIDE 79

Second Stages

Image credit: SpaceX

slide-80
SLIDE 80

Advanced Functionalities

  • Second stages implement similar concepts to

stay persistent and hidden on the system

  • They are meant to stay undected as long as

possible

slide-81
SLIDE 81

Carbon/ Cobra

slide-82
SLIDE 82

Overview

  • Evolution of the previous rootkit
  • Sophisticated backdoor
  • Receive and dispatch tasks from other nodes
slide-83
SLIDE 83

Architecture

  • Dropper
  • Loader
  • Orchestrator
  • Communication DLL
slide-84
SLIDE 84

Development Timeline

Compilation date Orchestrator version Communication library version 2014-02-26 3.71 3.62 2016-02-02 3.77 4.00 2016-03-17 3.79 4.01 2016-03-24 3.79 4.01 2016-04-01 3.79 4.03 2016-08-30 3.81 ???? 2016-10-05 3.81 ???? 2016-10-21 3.81 ????

slide-85
SLIDE 85

C&C Communication

  • Several steps are taken

before beaconing out

  • Check for network

sniffers

  • First GET request to root

page of C&C

  • Real request is made
slide-86
SLIDE 86

C&C Communication

  • Data that should be

sent to the C&C server is written to a file

  • Each blob is encrypted

with CAST-128

  • extra 3DES encryption is

configurable

slide-87
SLIDE 87

Tasks

  • Tasks are retrieved

from a webpage

  • Once decrypted, the

tasks are added to a queue

slide-88
SLIDE 88

Tasks

  • Tasks are retrieved

from a webpage

  • Once decrypted, the

tasks are added to a queue

slide-89
SLIDE 89

Named pipe Communications

  • Example of communication between modules
slide-90
SLIDE 90

Named pipe Communications

  • Tasks can be forwarded to another node
slide-91
SLIDE 91

Named pipe Communications

  • Tasks can be forwarded to another node
slide-92
SLIDE 92

Named pipe Communications

  • Tasks can be forwarded to another node
slide-93
SLIDE 93

Named pipe Communications

  • Tasks can be forwarded to another node
slide-94
SLIDE 94

Named pipe Communications

  • Tasks can be forwarded to another node
slide-95
SLIDE 95

Task configuration file

  • [CONFIG]
  • NAME (“cmd.exe” by default)
  • ARG
  • RESULT (“stdout” by default)
  • COMPRESSION (“yes” by default)
  • DELETE (“no” by default)
slide-96
SLIDE 96

Kazuar

slide-97
SLIDE 97

Overview

  • .NET backdoor
  • Crossplatform
  • Similar in architecture to Carbon
  • Plugin support
  • Working directory
  • Configuration file
  • Log file
  • […]
slide-98
SLIDE 98

ConfuserEx

  • LZMA code compression
  • Anti debug
  • Control flow obfuscation
  • Strings obfuscation
slide-99
SLIDE 99

ConfuserEx

  • LZMA code compression
  • Anti debug
  • Control flow obfuscation
  • Strings obfuscation
slide-100
SLIDE 100

Gazer/ White Bear

https://chocolate80y.deviantart.com/art/bear-snake-149185270

slide-101
SLIDE 101

Overview

  • The most recent 2nd stage backdoor
  • Similar architecture to the previously discussed

backdoors

slide-102
SLIDE 102

Gazer Architecture

slide-103
SLIDE 103

Gazer Architecture

slide-104
SLIDE 104

Gazer Architecture

slide-105
SLIDE 105

Process injection list

  • Standard ones:
  • iexplore.exe
  • firefox.exe
  • outlook.exe
  • chrome.exe
  • browser.exe
  • opera.exe
  • safari.exe
  • Custom ones:
  • osoupd.exe
  • acrotray.exe
  • UpdaterUI.exe
  • dropbox.exe
  • onedrive.exe
slide-106
SLIDE 106

Process injection list

  • Standard ones:
  • iexplore.exe
  • firefox.exe
  • outlook.exe
  • chrome.exe
  • browser.exe
  • opera.exe
  • safari.exe
  • Custom ones:
  • osoupd.exe
  • acrotray.exe
  • UpdaterUI.exe
  • dropbox.exe
  • onedrive.exe
slide-107
SLIDE 107

Skipper relationship

  • Seen in tandem
  • Usage of code signing

certificates

  • We have seen Gazer

being installed 24 hours after initial Skipper infection

slide-108
SLIDE 108

RunTime Type Information - RTTI

  • C++ class introspection (dynamic_cast, typeid,

exception dispatcher) requires additional information to be stored in binary

  • Gazer has this information. We can recover
  • Virtual Function Table (VFT)
  • Class names
  • Base classes
  • Bonus: some binaries included function names
slide-109
SLIDE 109

RunTime Type Information - RTTI

  • Looking for “.?AV” strings
slide-110
SLIDE 110

Similarities exposed

slide-111
SLIDE 111

Working directory similarities - Carbon

slide-112
SLIDE 112

Working directory similarities - Kazuar

slide-113
SLIDE 113

Working directory similarities - Kazuar

md5('log') XOR key

slide-114
SLIDE 114

Working directory similarities - Gazer

  • Moved to registry
  • %RootStoragePath%\{119D263D-68FC-1942-3CA3-46B23FA652A0}
  • Object ID: a unique ID to identify the victim
  • %RootStoragePath%\{1DC12691-2B24-2265-435D-735D3B118A70}
  • Task Queue: linked list of tasks to be executed
  • %RootStoragePath%\{28E74BDA-4327-31B0-17B9-56A66A818C1D}
  • Plugins
  • %RootStoragePath%\{31AC34A1-2DE2-36AC-1F6E-86F43772841F}
  • Communication Module: the DLL that communicates with the C&C server
  • %RootStoragePath%\{3CDC155D-398A-646E-1021-23047D9B4366}
  • Autorun: the persistency method
slide-115
SLIDE 115

Logs - Carbon

  • Encrypted with CAST-128
  • Format: Date|Time|Object-Id|Source|Mesage
slide-116
SLIDE 116

Logs - Kazuar

  • Encrypted with AES-256-CBC
  • Format: process_name [PID]: message
slide-117
SLIDE 117

Logs - Gazer

  • Encrypted with 3DES
  • Format: Hour:Min:Sec:Ms|[log ID] [log]
slide-118
SLIDE 118

Configuration items – Carbon/Kazuar/Gazer

  • Processes where to inject 3rd stage
  • Last C&C contact time
  • C&C list
  • Victim ID
  • Frequency and time of tasks execution
slide-119
SLIDE 119

Configuration file – Carbon/Kazuar/Gazer

  • Processes where to inject 3rd stage
  • Last C&C contact time
  • C&C list
  • Victim ID
  • Frequency and time of tasks execution
slide-120
SLIDE 120

Interlude - Metasm

slide-121
SLIDE 121

Leverage Metasm to dump encrypted data

  • Custom RSA implementation
  • Unable to decrypt data with standard libraries
  • Why not use directly Gazer code?
slide-122
SLIDE 122

Metasm

  • Assembler / Disassembler / Compiler /

Debugger

slide-123
SLIDE 123

Metasm

  • Assembler / Disassembler / Compiler /

Debugger

  • Scriptable in Ruby
slide-124
SLIDE 124

Metasm

  • Assembler / Disassembler / Compiler /

Debugger

  • Scriptable in Ruby
slide-125
SLIDE 125

Metasm

  • Assembler / Disassembler / Compiler /

Debugger

  • Scriptable in Ruby
  • https://github.com/jjyg/metasm
slide-126
SLIDE 126

Script

  • 1. Put breakpoints on specific addresses
  • 2. Debug the Gazer sample
  • 3. Dump unencrypted data
slide-127
SLIDE 127

Script

https://github.com/eset/malware-research/tree/master/turla/gazer_util.rb

slide-128
SLIDE 128

Infrastructure

slide-129
SLIDE 129

First layer C&C server

slide-130
SLIDE 130

SATCOM Infrastructure

  • Hide real C&C addresses
  • Attribution is more difficult
  • Take-down almost impossible
slide-131
SLIDE 131
slide-132
SLIDE 132

Infected machine

slide-133
SLIDE 133

Infected machine Satellite broadcasts traffic

slide-134
SLIDE 134

Infected machine SIGINT interception Satellite broadcasts traffic

slide-135
SLIDE 135

Infected machine SIGINT interception Real C&C server. Uses the IP address of a real SAT customer. Satellite broadcasts traffic

slide-136
SLIDE 136

Playing cat and mouse

  • Gazer change in IOCs
  • Carbon changes in IOCs
  • Nautilus changes after NCSC UK report
  • Mosquito DLLs no longer dropped on disk after
  • ur publication
slide-137
SLIDE 137

Conclusion

  • Turla is still very active
  • Really effective at tricking the users
  • Large toolset
  • Most advanced backdoors used on the most protected

networks

slide-138
SLIDE 138

www.eset.com | www.welivesecurity.com Senior Malware Researcher

Matthieu Faou

Malware Researcher @jiboutin @matthieu_faou

Jean-Ian Boutin