examples of modern malware
play

Examples of modern malware Malware Analysis Seminar Meeting 7 - PowerPoint PPT Presentation

Jun 09, 2023 •267 likes •703 views

Examples of modern malware Malware Analysis Seminar Meeting 7 Cody Cutler, Anton Burtsev Stuxnet (2009) Organization Core a large .dll file 2 encrypted configuration files Dropper component Core in a stub section

  1. Examples of modern malware Malware Analysis Seminar Meeting 7 Cody Cutler, Anton Burtsev

  2. Stuxnet (2009)

  3. Organization ● Core ● a large .dll file ● 2 encrypted configuration files ● Dropper component ● Core in a “stub” section ● Core is mapped into memory as a module – Control passed to one of the export functions ● A pointer to the “stub” section is always passed around: ● All components of Stuxnet have access to core, and config files

  6. Bypassing behavior detection ● Bypasses intrusion detection software which monitors LoadLibrary calls ● call LoadLibrary with a special crafted, nonexistent file name – LoadLibrary will fail – Stuxnet hooks Ntdll.dll to monitor these calls

  7. Process injection ● When an export is called Stuxnet injects itself into another process, then calls the export ● Tries to bypass behavior detection ● Extracts a template PE from itself – Large enough so the entry point falls into this template ● Writes template into another process ● Unsuspend ● Core dll file is passed via mapping a shared section

  8. Trusted processes ● Kaspersky KAV (avp.exe) ● Mcafee (Mcshield.exe) ● AntiVir (avguard.exe) ● BitDefender (bdagent.exe) ● Etrust (UmxCfg.exe) ● F-Secure (fsdfwd.exe) ● Symantec (rtvscan.exe) ● Symantec Common Client (ccSvcHst.exe) ● Eset NOD32 (ekrn.exe) ● Trend Pc-Cillin (tmpproxy.exe)

  9. Check for non-bypassable AV ● Scan registry for indication that the following programs are installed ● KAV v6 to v9 ● McAfee ● Trend PcCillin ● Extracts version information of the main image ● Chooses target injection process, or ● Fails infection

  11. Installation

  12. Installation step 2

  13. Load point after reboot ● MrxCls driver ● Signed by a compromised Verisign certificate ● Another version is signed by Jmicron ● Registered as a boot start service ● HKEY_LOCAL_MACHINE\SYSTEM\CurrentControl Set\Services\MRxCls\”ImagePath” = “%System %\drivers\mrxcls.sys” ●

  14. Injection ● MrxCls injects Stuxnet into specific processes ● services.exe, S7tgtopx.exe, CCProjectMgr.exe – %Windir%\inf\oem7A.PNF (main Stuxnet) ● explorer.exe – never injected in the wild

  15. Command and control ● Connects via HTTP (port 80) – www[.]mypremierfutbol[.]com, www[.]todaysfutbol[.]com ● System information is collected by export 28 – Machine and domain name – Siemens Step7 and WinCC

  17. Connection ● Export 29 sends the information ● Injects itself into iexplore.exe, or default browser ● Checks Internet connectivity by contacting – www.windowsupdate.com, www.msn.com ● Payload is ● XOR'ed with 0xFF ● XOR'ed with 31-byte long byte string ● And turned into ASCI-only characters (0x23, 0x12 → 2312) – A way to bypass corporate firewalls ● Payload is sent via data parameter ● www.mypremierfutbol.com/index.php?data=2312...

  19. Backdoor ● Upload and run any code on the infected machine

  20. Rootkit ● Hide exploit files on the removable drives ● MrxNet.sys interposes on the FS chain ● Scans for the file system driver objects – \FileSystem\ntfs, \FileSystem\fastfat, \FileSystem\cdfs ● Inserts itself into driver chain to intercept FS requests – Filters out its files

  21. Propagation ● WinCC hardcoded password ● Network shares ● Print spooler 0-day ● Windows Server Service vulnerability ● Removable drives ● LNK vulnerability

  22. Duqu (October 2011)

  23. Exploit shellcode ● 0-day vulnerability in word ● Two encrypted files: ● Driver ● Installer DLL ● Injects code into services.exe ● Removes itself ● Whipes memory

  24. Installer ● Decrypts 3 files from within itself ● Main .dll ● .sys driver (load point after reboot) ● Installer configuration file – 8-day installation timeframe ● Installer hooks Ntdll.dll like Stuxnet ● Injects itself into appropriate process ● Installs the .sys driver to be loaded on boot ● Main .dll is encrypted and placed into %Wndir%\inf ● It will be decrypted and executed on every boot

  26. Installation ● 3 files are left on disk ● Driver, encrypted main .dll, encrypted main .dll configuration file ● Installation is quite involved ● 7 files are decrypted ● 3 processes are injected into ● ntdll.dll is hooked multiple times ● Only one unencrypted file (load point .sys driver is written to disk)

  27. Load point (JMINET7.SYS) ● Registered driver starts on boot ● Makes sure – no debugger is running – not in the safe mode ● Encryption key for main .dll is in the registry – Also encrypted – Multiplication rolling key scheme ● Injects main .dll into services.exe – Registers a callback on PsSetLoadImageNotifyRoutine – Notification every time DLL or EXE is loaded

  28. Main .dll (NETP191.PNF) ● Checks if the sample is running for less than 30 days ● If no calls clean up routine ● Checks Internet connectivity ● DNS lookup ● Injects itself into one of the processes ● Explorer.exe, IExplore.exe, Firefox.exe, Pccntmon.exe ● Tries to bypass AV products ● Similar to Stuxnet

  29. Payload loader (Resource 302) ● Loads payload into memory and executes it in different ways

  30. Command and Control ● Download and execute files ● In memory or write to disk ● Protocols ● Encapsulated in HTTP over port 80 ● Encapsulated in HTTP over port 80 using a proxy (may be authenticated) ● Directly over port 443 ● Encapsulated in HTTPS over port 443 ● Encapsulated in SMB – Primarily for P2P command and control

  31. Protocols: HTTP & HTTPs ● Repeated GET requests to the server ● Server replies with modules to execute ● To return data Duqu uses POST with a small JPEG

  32. Direct port 433 & named pipes ● Duqu C&C is a reliable transport protocol similar to TCP ● Fragmentation, reordering, duplicate and missing packets ● Sequence and ACK numbers

  33. Direct port 433 & named pipes ● Data is encrypted and compressed ● AES key is hardcoded ● Different with each version ● VI information is exchanged in plain text ● Cookie is unique for every request ● Validated by server and client

  36. Peer-to-peer C&C ● Proxy C&C traffic to the Internet from a secured zone ● Infected computer is configured to connect back ● Connection information of the infecting computer

  37. Downloaded threats ● Info stealer ● Lists of running processes, account details, and domain information ● Drive names and other information, including those of shared drives ● Screenshots ● Network information (interfaces, routing tables, shares list, etc.) ● Key presses ● Open window names ● Enumerated shares ● File exploration on all drives, including removable drives ● Enumeration of computers in the domain through NetServerEnum ● Lifespan extender ● Simpler info stealer

  38. Propagation ● Collect network information ● Download keylogger – Collect password information ● Collect network information ● C&C instructs what to do next ● Copy itself to a network share – Authenticate with the collected password information ● Trigger execution of a file via a scheduled task on infected machine

  39. Flame (October 2011 - now)

  40. Organization ● Well designed cyber-espionage tookit ● Web server ● Database server ● SOCKS proxy, SSH ● LUA script interpreter – LUA is a scripting language designed to be embedded into other applications – Easy way to extend functionality of applicaton ● Some sort of a file system to access resources and scripts

  41. Propagation ● Network shares ● Collected credentials ● Windows print spooler (used by Stuxnet) ● Removable media ● autorun.inf (used by Stuxnet) ● LNK vulnerability (used by Stuxnet)

  42. Information collection ● Screenshots ● Recorded video ● Recorded audio ● Nearby bluetooth devices

  43. Acknowledgements ● W32.Stuxnet Dossier. Nicolas Falliere, Liam O Murchu, and Eric Chien. Symantec Security Response. ● W32.Duqu The precursor to the next Stuxnet. Symantec Security Response.

Recommend

The Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen

The Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen

The Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 Introduction 2/18 What is Intel SGX? Intel Software Guard Extension (SGX) A vault (enclave) to

353 views • 19 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Sandboxing & Virtualization: Modern Tools for Combating Malware Anup K. Ghosh, PhD Founder

Sandboxing & Virtualization: Modern Tools for Combating Malware Anup K. Ghosh, PhD Founder

Sandboxing & Virtualization: Modern Tools for Combating Malware Anup K. Ghosh, PhD Founder anup@invincea.com www.invincea.com Research Professor Center for Secure Information Systems George Mason University May 2010 The User IS the

479 views • 20 slides
Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network

Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network

Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network Traces Roberto Perdisci (1,2) , Wenke Lee (1,2) , Nick Feamster (1) (1) (2) USENIX NSDI 2010 Malware = Malicious Software Most modern cyber

601 views • 31 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

570 views • 22 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
MODERN 1 MODERN 2 MODERN 3 MODERN 4 MODERN A peep at some distant orb has power to raise

MODERN 1 MODERN 2 MODERN 3 MODERN 4 MODERN A peep at some distant orb has power to raise

MODERN 1 MODERN 2 MODERN 3 MODERN 4 MODERN A peep at some distant orb has power to raise and purify our thoughts like a strain picture, or a passage from the grander poets. It always does one good. 5 MODERN 6 MODERN 7 MODERN 8

524 views • 24 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware malware that evades analysis 2 logistics: LEX homework detect push ret pattern using fmex probably easier than TRICKY 3 upcoming exam next Wednesday

496 views • 48 slides
Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

DeepSec IDSC Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware Adventures Agenda INTRODUCTION ANDROID MALWARE COMMAND & CONTROL QUESTIONS & ANSWERS 2 1 2 3 4 Android Malware

1.01k views • 64 slides
Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of Computer and Information Science Linkping University Malware Defense Agenda 2 Two lectures Lecture I : Malware basics, malware on the PC,

621 views • 40 slides
FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for Malware Amount of malware is growing exponentially Anti-virus and signature based approaches are reactionary, dont work for novel malware

127 views • 11 slides
CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is software that aids in gathering A virus is a computer program that is information about a person or organization capable of making copies of itself

716 views • 56 slides
CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane kaneca@mail.uc.edu January 24, 2017 Why Classification is Important Malware classification helps us in multiple ways. Here are a couple key ways:

787 views • 16 slides
On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware Detection The number of new malware exceeds 75 million by the end of 2011, and is still increasing. The number of malware that produced

1.34k views • 91 slides
Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning

Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning

Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning Objectives By the end of this week, you will be able to: Describe types of malware See certain malware behaviors Scan and analyze malware

883 views • 25 slides
Lecture 12 Malware Defenses Stephen Checkoway University of Illinois at Chicago CS 487

Lecture 12 Malware Defenses Stephen Checkoway University of Illinois at Chicago CS 487

Lecture 12 Malware Defenses Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides based on Baileys ECE 422 Malware review How does the malware start running? Logic bomb? Trojan horse? Virus?

470 views • 27 slides
Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal and Wenke Lee College of Computing Georgia Institute of Technology Agenda l Background l Defeating Automated Malware Analysis Host

1.28k views • 28 slides
More Malware Last Class Worms: Morris Worm Stuxnet Conficker Web-based

More Malware Last Class Worms: Morris Worm Stuxnet Conficker Web-based

More Malware Last Class Worms: Morris Worm Stuxnet Conficker Web-based malware: Exploit kits Fake AV Ransomware Today (continuation) How Malware Spreads Adware Computer Virus A type of malicious

647 views • 23 slides

More recommend