reversing 2020 yara summit pushing the barriers of unique
play

Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA - PowerPoint PPT Presentation

Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 1 TLP-GREEN TOM UELTSCHI YARA-SUMMIT 2020 C:> whoami /all Tom Ueltschi Swiss Post CERT / SOC / CSIRT since 2007 (13 years!) Focus


  1. Outline • Introduction • Automate malware analysis (how far can you go?) • Using YARA on “uncommon” or “unusual” file types • PCAP files • memory-strings & mutexes • JAR’s (Java RAT’s) • “DESKTOP-group” -- Spear Phishing emails & mail headers • YARA for email headers and body • Weird file formats: MSI + JAR || RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 34

  2. Using YARA on “uncommon” or “unusual” file types Java RATs and JAR files Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 35

  3. Using YARA on “uncommon” or “unusual” file types Java RATs and JAR files Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 36

  4. Using YARA on “uncommon” or “unusual” file types Java RATs and JAR files Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 37

  5. Using YARA on “uncommon” or “unusual” file types Java RATs and JAR files Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 38

  6. Using YARA on “uncommon” or “unusual” file types Java RATs and JAR files Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 39

  7. Using YARA on “uncommon” or “unusual” file types Java RATs and JAR files Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 40

  8. Outline • Introduction • Automate malware analysis (how far can you go?) • Using YARA on “uncommon” or “unusual” file types • PCAP files • memory-strings & mutexes • JAR’s (Java RAT’s) • “DESKTOP-group” -- Spear Phishing emails & mail headers • YARA for email headers and body • Weird file formats: MSI + JAR || RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 41

  9. First Hand Knowledge Analyzing mail headers • Date • From (display-name / email) • Subject • Attachment(s) – Filename(s) / MD5 hash(es) à Malware Analysis • Message-ID à Malware / RAT Family • X-Mailer / User-Agent à C2 domain / IP / port • X-Source-Auth / X-Sender / Authenticated-Sender • X-Source-IP / X-Originating-IP • Received headers à Client IP Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 42

  10. First Hand Knowledge Analyzing mail headers à Excel with >140 attack mails Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 43

  11. Message-ID / DESKTOP-name / X-Mailer Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 44

  12. Received header hostname = Message-ID host Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 45

  13. Received hostname ( WIN-xxx ß DESKTOP-xxx ) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 46

  14. Message-ID / (9) Desktop-/ (2) Server-names Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 47

  15. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on any header Message-ID header Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 48

  16. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on any header Received headers Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 49

  17. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on any header From header X- / Auth.-Sender Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 50

  18. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on body URLs URLs in body (base64) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 51

  19. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on body URLs URLs in body (base64) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 52

  20. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on body URLs URLs in body (base64) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 53

  21. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on body URLs URLs in body (base64) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 54

  22. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on any header Blocked only due to custom YARA rule Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 55

  23. Why should I care about mail headers Use YARA rules on raw RFC2822 mails to block on any header Blocked only due to custom YARA rule Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 56

  24. Outline • Introduction • Automate malware analysis (how far can you go?) • Using YARA on “uncommon” or “unusual” file types • PCAP files • memory-strings & mutexes • JAR’s (Java RAT’s) • “DESKTOP-group” -- Spear Phishing emails & mail headers • YARA for email headers and body • Weird file formats: MSI + JAR || RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 57

  25. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 58

  26. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 59

  27. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 60

  28. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 61

  29. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 62

  30. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 63

  31. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 64

  32. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 65

  33. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 66

  34. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 67

  35. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 68

  36. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 69

  37. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 70

  38. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 71

  39. Outline • Introduction • Automate malware analysis (how far can you go?) • Using YARA on “uncommon” or “unusual” file types • PCAP files • memory-strings & mutexes • JAR’s (Java RAT’s) • “DESKTOP-group” -- Spear Phishing emails & mail headers • YARA for email headers and body • Weird file formats: MSI + JAR || RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 72

  40. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 73

  41. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 74

  42. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 75

  43. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS 7 x EXCEL.EXE 7 x PS cmd (1) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 76

  44. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS 1 x PS cmd (2) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 77

  45. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 78

  46. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 79

  47. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 80

  48. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Pow-er-sh-ell Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 81

  49. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 82

  50. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 83

  51. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 84

  52. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 85

  53. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 86

  54. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 87

  55. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 88

  56. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 89

  57. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS Office files Last saved / author Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 90

  58. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS (Hunting @ home) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 91

  59. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS (Hunting @ home) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 92

  60. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: RTF + XLS (Hunting @ home) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 93

  61. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR || RTF + XLS (Hunting @ VT) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 94

  62. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR || RTF + XLS (Hunting @ VT) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 95

  63. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR || RTF + XLS (Hunting @ VT) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 96

  64. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR || RTF + XLS (Hunting @ RL) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 97

  65. “DESKTOP-group” -- Spear Phishing emails & mail headers Weird file formats: MSI + JAR || RTF + XLS (Hunting @ RL) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 98

  66. Outline • Introduction • Automate malware analysis (how far can you go?) • Using YARA on “uncommon” or “unusual” file types • PCAP files • memory-strings & mutexes • JAR’s (Java RAT’s) • “DESKTOP-group” -- Spear Phishing emails & mail headers • YARA for email headers and body • Weird file formats: MSI + JAR || RTF + XLS (Hunting @ home / VT / RL) Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 99

  67. Thanks for your attention!! Time left for questions? • Twitter: @c_APT_ure • Blog: http://c-apt-ure.blogspot.com/ à all my presentations linked in one place Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 100

Recommend


More recommend