pinkslipbot a deep look at how malicious code adapts and
play

Pinkslipbot: A deep look at how malicious code adapts and evolves - PowerPoint PPT Presentation

Jun 29, 2023 •460 likes •662 views

Pinkslipbot: A deep look at how malicious code adapts and evolves Guilherme Venere Malware Researcher Anti Malware Operation Team Know Your Enemy Server-side polymorphic worm. EXE and DLL modules First seen around 2007 Features

  1. Pinkslipbot: A deep look at how malicious code adapts and evolves Guilherme Venere Malware Researcher Anti Malware Operation Team

  2. Know Your Enemy • Server-side polymorphic worm. EXE and DLL modules • First seen around 2007 • Features common backdoor functionalities • Spread method • Compromised webpages with injected code • Network shares (exploits included!) • AutoRun (mostly old variants) • Spam E-mail attachments (old variants) • No known source code available • Very effective in local corporate networks due to spread methods • This received attention from the media last year http://www.techweekeurope.co.uk/news/nhs-computers-hit-by-qakbot-infection-6636 http://www.bankinfosecurity.com/breach-may-have-targeted-jobless-a-3655 http://www.infosecurity-magazine.com/view/18164/qakbot-author-is-no-crackpot- says-symantec/ • Actively developed over the years 2

  3. Pinkslipbot historic data • Outbreaks follow defined pattern • Interim time used for development • Major code change around 2009 improved effectiveness • But that had its consequences: too much attention! • Low profile lately. • Major code change in sight? 3 June 14, 2012

  4. Pinkslipbot historic data This Google Maps view shows reported infections by Pinkslipbot in 2011 2009 2010 2011 2012 4 June 14, 2012

  5. Pinkslipbot network model 2009 2010 2011 2012 5 June 14, 2012

  6. Pinkslipbot network model hostrmeter.com:31666 up002.cn adserv.co.in up004.cn up01.co.in up02.co.in upa01.in nt14.in incitylocal.com www.cdcdcdcdc2121cdsfdfd.com ppcimg.in du01.in yimg.com.ua du02.in corpgift.in yimg.com.ua soros.in.ua citypromo.info googstat.info w1.webinspector.biz 109.95.114.252 bgstat.in abirvalg.co.in a.rtbn2.cn redserver.com.ua:31666 nt202.cn 69.175.80.89:21 c.rtbn2.cn up002.cn spotrate.info 195.3.145.32:8080 www.cdcdcdcdc2121cd adserv.co.in karnadya.com.my sfdfd.com up004.cn flwest.com www.cdcdcdcdc2121c ijk.cc falahuddarain.com dsfdfd.com w1.madway.net silfersystem.com Irc.zief.pl:65520 w1.rstk.us gemini.com.co 2009 2010 2011 2012 6 June 14, 2012

  7. Pinkslipbot prehistory • Packer/Obfuscation varies wildly • Some samples with strings in Russian • Samples were small (~14KB-45KB) • Configuration uses Rolling-XOR encryption called SXOR by virus authors • Spread methods included spam with zipped DOC attachments • Default password ‘ Hello999W0rld777 ’ • Infection count low • Group behind it is not well organized yet 2009 2010 2011 2012 7 June 14, 2012

  8. Pinkslipbot – Q1 2010 • Many samples using custom packer • Client side polymorphism • Wild variety of code seen in samples • Apparently the group behind Pinkslipbot attempt major rework of code • Seems they were not successful 2009 2010 2011 2012 8 June 14, 2012

  9. Pinkslipbot – Q2 2010 • File obfuscation start to look like those used by Zeus • Starts to use server-side polymorphism • Almost no changes since 2009 • Reverted to old code • Users of the following banks were targeted: 2009 2010 2011 2012 9 June 14, 2012

  10. Pinkslipbot – Q2 2010 2009 2010 2011 2012 10 June 14, 2012

  11. Pinkslipbot – Q3/Q4 2010 • Major code change. Base for today’s version • EXE keep DLL alive in processes • Adds features to steal digital certificates • Download BackDoor-EXI, fully featured backdoor • Pinkslipbot begins to disable AV by changing NTFS ACL permissions Infected Clean 2009 2010 2011 2012 11 June 14, 2012

  12. Pinkslipbot – Q3/Q4 2010 • Change in network infrastructure to bulletproofed servers in Ukraine • Stolen data sent to FTP server • Able to infect HTML files (.asp, .pl, .php, .htm, .cfm) with <script> code • Users of the following banks were targeted: 2009 2010 2011 2012 12 June 14, 2012

  13. Pinkslipbot – Q1/Q2 2011 • Starts to use UPX + second-level obfuscator • Social Engineering: AutoRun variant uses folder icons • DLL component and configuration now comes embedded in EXE resource section • Users of the following banks were targeted: 2009 2010 2011 2012 13 June 14, 2012

  14. Pinkslipbot – Q1/Q2 2011 • First variants featuring user-mode rootkits • Used to protect the main EXE and to hijack IE functions iphlpapi.dll!GetTcpTable ntdll.dll!NtQuerySystemInformation iphlpapi.dll!AllocateAndGetTcpExTableFromStack ntdll.dll!NtResumeThread WS2_32.dll!connect kernel32.dll!GetProcAddress WS2_32.dll!send WININET.dll!InternetCloseHandle WS2_32.dll!WSASend WININET.dll!HttpOpenRequestA WS2_32.dll!WSAConnect WININET.dll!InternetReadFile ADVAPI32.dll!RegEnumValueW WININET.dll!InternetQueryDataAvailable ADVAPI32.dll!RegEnumValueA WININET.dll!HttpSendRequestA USER32.dll!TranslateMessage WININET.dll!HttpSendRequestW USER32.dll!GetClipboardData WININET.dll!InternetReadFileExA USER32.dll!CharToOemBuffA 2009 2010 2011 2012 14 June 14, 2012

  15. Pinkslipbot – Q3/Q4 2011 • Intense development cycle • Not very effective in customer networks • Hints that they might be targeting specific AV features • First stolen digital certificates being used in binaries • Change in SXOR encryption for configuration file • New heavy encryption layer added 2009 2010 2011 2012 15 June 14, 2012

  16. Pinkslipbot – Q3/Q4 2011 2009 2010 2011 2012 16 June 14, 2012

  17. Pinkslipbot – Q1 2012 • Obfuscator looks more and more like that used by Zeus variants • Virus activity under control • Activity from update server: Unique samples from yimg.com.ua 30 25 20 15 10 5 0 2011-03 2011-04 2011-05 2011-06 2011-09 2011-10 2011-11 2011-12 2012-01 2012-02 2012-03 2009 2010 2011 2012 17 June 14, 2012

  18. Future (Current) Developments • New variant showing up week prior to this conference • New obfuscation, same as many Zbot variants • Doubled number of affected banks • Change in behavior: � DLL module is directly injected in memory (no file on disk!) • Future developments • Improved rootkit • More anti-AV features • Change in spread method • Interaction with other malware families • Partner with another backdoor or integrate in its own code • Code integration with Zeus 2009 2010 2011 2012 18 June 14, 2012

  19. Acknowledgments • McAfee Labs Threat Advisory • https://kc.mcafee.com/corporate/index?page=content&id=PD22960 • McAfee Labs Sample Database Team • Personal Communication (McAfee Labs): Abhishek Karnik, Mark Olea, Srinivasa Kanamatha, François Paget • For contributions during preparation of this report: • Jacomo Dimmit (Team Cymru) • Ivo Peixinho (Brazilian Federal Police) Guilherme_Venere@mcafee.com @gvenere 19

Recommend

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu mihai@cs.wisc.edu 10 March 2005 What is Malicious Code? What is Malicious Code? Viruses, worms, trojans, Code that breaks your security policy.

1.16k views • 94 slides
Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu mihai@cs.wisc.edu 23 March 2006 What is Malicious Code? What is Malicious Code? Viruses, worms, trojans, Code that breaks your security policy.

707 views • 69 slides
Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu mihai@cs.wisc.edu 29 March 2007 SYN Cookies (contd) SYN Cookies (contd) SYN cookies are particular choices of initial TCP sequence numbers

868 views • 62 slides
Malicious Code and Access Control in SDN SPRING14 , 31.7. 1.8.2014 Hans Christian Rpke

Malicious Code and Access Control in SDN SPRING14 , 31.7. 1.8.2014 Hans Christian Rpke

Malicious Code and Access Control in SDN SPRING14 , 31.7. 1.8.2014 Hans Christian Rpke Chair for System Security 1 Introduction 2 Malicious Code in SDN 3 Access Control in SDN 4 Conclusions Software-Defined Networks|Horst Grtz

418 views • 19 slides
Lines of Malicious Code: Insights Into the Malicious Software Industry Martina Lindorfer

Lines of Malicious Code: Insights Into the Malicious Software Industry Martina Lindorfer

Lines of Malicious Code: Insights Into the Malicious Software Industry Martina Lindorfer Vienna University of Technology Alessandro Di Federico Politecnico di Milano Federico Maggi Politecnico di Milano Paolo Milani Comparetti Vienna

566 views • 27 slides
MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs

MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs

MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs on a victims system How does it get to run? Attacks a user- or network-facing vulnerable service Backdoor: Added by a malicious

1.02k views • 81 slides
Malicious Code Karlstads universitet mCrowds: Anonymity for the mobile Internet Karlstads

Malicious Code Karlstads universitet mCrowds: Anonymity for the mobile Internet Karlstads

2005-10-12 Malicious Code an Increasing Problem Malicious Code Karlstads universitet mCrowds: Anonymity for the mobile Internet Karlstads universitet DAV C19 Applied Security 2 Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Media

442 views • 7 slides
Untangling the code An overview of techniques to reverse engineer malicious software Prashant

Untangling the code An overview of techniques to reverse engineer malicious software Prashant

Untangling the code An overview of techniques to reverse engineer malicious software Prashant Gupta Security Architect, McAfee Inc. June 3, 2013 McAfee Confidential Internal Use Only Abstract Reverse engineering and analysis of binary code

381 views • 20 slides
Viruses based on slides by Vitaly Shmatikov and Ninghui Li Malware Malicious code often

Viruses based on slides by Vitaly Shmatikov and Ninghui Li Malware Malicious code often

Viruses based on slides by Vitaly Shmatikov and Ninghui Li Malware Malicious code often masquerades as good software or attaches itself to good software Some malicious programs need host programs Trojan horses, logic bombs, viruses

624 views • 40 slides
Vulnerabilities: Malicious Code Class 10 P&amp;P: Ch 3.3, 3.4 1 CIS-5372: 9.Nov.2011

Vulnerabilities: Malicious Code Class 10 P&amp;P: Ch 3.3, 3.4 1 CIS-5372: 9.Nov.2011

Vulnerabilities: Malicious Code Class 10 P&amp;P: Ch 3.3, 3.4 1 CIS-5372: 9.Nov.2011 Announcement Presence sheet Solution to Homework 2 is out Grades will follow 2 CIS-5372: 9.Nov.2011 What Did We Cover Before ?

1.02k views • 71 slides
CS 356 Lecture 8 Malicious Code Spring 2013 Review Chapter 1: Basic Concepts and

CS 356 Lecture 8 Malicious Code Spring 2013 Review Chapter 1: Basic Concepts and

CS 356 Lecture 8 Malicious Code Spring 2013 Review Chapter 1: Basic Concepts and Terminology Integrity, Confidentiality, Availability, Authentication, and Accountability Types of threats: active vs. passive, insider/outsider

638 views • 16 slides
CS 356 Lecture 9 Malicious Code Spring 2013 Review Chapter 1: Basic Concepts and

CS 356 Lecture 9 Malicious Code Spring 2013 Review Chapter 1: Basic Concepts and

CS 356 Lecture 9 Malicious Code Spring 2013 Review Chapter 1: Basic Concepts and Terminology Integrity, Confidentiality, Availability, Authentication, and Accountability Types of threats: active vs. passive, insider/outsider

347 views • 33 slides
Engineering Challenges in Immunizing Systems Against Malicious Code Craig Chamberlain Principal

Engineering Challenges in Immunizing Systems Against Malicious Code Craig Chamberlain Principal

Engineering Challenges in Immunizing Systems Against Malicious Code Craig Chamberlain Principal Technical Consultant Verdasys, Inc. Background Organizations are confronted with troubling developments the malware problem phenomenon

581 views • 27 slides
Tomer Teller Why are we here? (one of many reasons) A malicious program: Allocates memory

Tomer Teller Why are we here? (one of many reasons) A malicious program: Allocates memory

Adi Hayon Tomer Teller Why are we here? (one of many reasons) A malicious program: Allocates memory in a remote process (and write to it) Executes the code in that memory region Frees the code Memory dump taken at the end of

373 views • 22 slides
Outline Malicious Code Introduction CS 239 Viruses Trojan horses Security for

Outline Malicious Code Introduction CS 239 Viruses Trojan horses Security for

Outline Malicious Code Introduction CS 239 Viruses Trojan horses Security for Networks and Trap doors System Software Logic bombs May 12, 2002 Worms Examples Lecture 11 Lecture 11 Page 1 Page 2 CS 239,

234 views • 12 slides
Undermining the Linux Kernel: Malicious Code Injec:on via /dev/mem Anthony Lineberry

Undermining the Linux Kernel: Malicious Code Injec:on via /dev/mem Anthony Lineberry

Undermining the Linux Kernel: Malicious Code Injec:on via /dev/mem Anthony Lineberry anthony.lineberry@gmail.com Black Hat Europe 2009 Overview What is a rootkit? Why is protec:on difficult? Current protec:on mechanisms/bypasses

638 views • 52 slides
Outline Introduction Malicious Code Viruses CS 236 Trojan horses Computer

Outline Introduction Malicious Code Viruses CS 236 Trojan horses Computer

Outline Introduction Malicious Code Viruses CS 236 Trojan horses Computer Security Trap doors March 14, 2007 Logic bombs Worms Examples Lecture 15 Lecture 15 Page 1 Page 2 CS 236, Winter 2007 CS 236,

341 views • 12 slides
Outline Introduction Malicious Code Viruses CS 239 Trojan horses Computer

Outline Introduction Malicious Code Viruses CS 239 Trojan horses Computer

Outline Introduction Malicious Code Viruses CS 239 Trojan horses Computer Security Trap doors March 15, 2004 Logic bombs Worms Examples Lecture 16 Lecture 16 Page 1 Page 2 CS 239, Winter 2004 CS 239,

408 views • 12 slides
Malicious Bytecode Peter Cawley &lt;lua@corsix.org&gt; Lua Workshop 2011 A Common Pattern 1.

Malicious Bytecode Peter Cawley &lt;lua@corsix.org&gt; Lua Workshop 2011 A Common Pattern 1.

Mitigating the Danger of Malicious Bytecode Peter Cawley &lt;lua@corsix.org&gt; Lua Workshop 2011 A Common Pattern 1. Create sandbox 2. Load user-supplied Lua (byte|source) code 3. Run code in sandbox A Common Pattern 1. Create sandbox 2.

369 views • 35 slides
I-see-3D ! An interactive and immersive system that dynamically adapts 2D projections to the

I-see-3D ! An interactive and immersive system that dynamically adapts 2D projections to the

I-see-3D ! An interactive and immersive system that dynamically adapts 2D projections to the location of a users eyes S. Pi erard, V. Pierlot, A. Lejeune and M. Van Droogenbroeck INTELSIG, Montefiore Institute, University of Li` ege,

450 views • 18 slides
Everyones a Target Criminals are Always Two Steps Ahead 90% of all cybercrime costs are

Everyones a Target Criminals are Always Two Steps Ahead 90% of all cybercrime costs are

Hackers are Equal Opportunity Businessmen: Everyones a Target Criminals are Always Two Steps Ahead 90% of all cybercrime costs are caused by web attacks, malicious code and malicious insiders. Kaspersky 60% of enterprises said

449 views • 13 slides
Malicious Software Countermeasures Summary ITS335: IT Security Sirindhorn International

Malicious Software Countermeasures Summary ITS335: IT Security Sirindhorn International

ITS335 Malicious Software Malicious Software Propagation Payload Malicious Software Countermeasures Summary ITS335: IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 25 October

673 views • 30 slides
Smelling Source Code Using Deep Learning Tushar Sharma http://www.tusharma.in What is a smell?

Smelling Source Code Using Deep Learning Tushar Sharma http://www.tusharma.in What is a smell?

Smelling Source Code Using Deep Learning Tushar Sharma http://www.tusharma.in What is a smell? certain structures in the code that suggest (sometimes they scream for) the possibility of refactoring . - Kent Beck 20 Definitions of smells:

766 views • 35 slides
Introduction to Malicious Web Sites Ktcl Web Sitelerine Bir lk Bak Ali Ikinci

Introduction to Malicious Web Sites Ktcl Web Sitelerine Bir lk Bak Ali Ikinci

OWASP T urkey - Uygulama Gvenlii Gn Introduction to Malicious Web Sites Ktcl Web Sitelerine Bir lk Bak Ali Ikinci Siber Gvenlik Dernei ali@ikinci.info 9 June 2012 Turkey About Me Working on Malicious Web Sites

505 views • 31 slides

More recommend