reverse engineering malware: a look inside operation tovar

Reverse Engineering Malware: A look inside Operation TovarBrandon TanseySecurity Researcher, Lancope

Source: 2014 Verizon DBIR

75% of malware contained functionality of spyware/keyloggers

55% of malware automatically collected pre-existing data on victim computers

Source: 2013 Verizon DBIR

All malware leaves behind some information of its own

Malware Analysis

• Command and control hosts• Encryption keys• Implementation flaws• Exploits• Malware capabilities• …

What information is there to find?

What information do you need?

Dynamic Analysis vs. Static Analysis

Initialization1. Start the malware

2. Malware loads RSAenh.dll (Microsoft Enhanced Cryptographic Provider)

Establishing Persistence3. Copy self to Application Data

4. Open second process

Establishing Persistence5. Maintain auto-start registry keys

Reaching Out6. Make network calls

7. Start looking for command and control hosts

Establish C2

8. Find valid C2 host

Compromise9. Store public key

10. Scan and encrypt files

Close loop11. Log encrypted files and start over

• Takes advantage of advanced public key crypto– RSAenh.dll– PublicKey registry key

• Loops through DNS requests for tons of gibberish hosts until it finds active, real one– All samples appear to create the same domains

• Does not begin encrypting until it receives public key from C2 server

What do we think we know?

Static Analysis

Source: microsoft.com

Source: justice.gov

Operation Tovar

Source: justice.gov

Operational Security(OPSEC)

Source: archive.gov

Source: justice.gov

“In cooperation with Luxembourg law enforcement agencies, pursuant to an

MLAT request, the FBI analyzed the contents of [second level Cryptolocker]

server, discovering HTTP access logs that showed which users were accessing this

server.”

Source: justice.gov

“This consistent pattern of overlapping IP addresses and user agent strings establishes

that Bogachev was the individual utilizing and managing the [Gameover] infrastructure.

Moreover, the fact that Bogachev had elevated Administrative access to the critical UK GOZ

server establishes that he is not only a participant in the GOZ conspiracy, but a

leader.” Source: justice.gov

Source: justice.gov

Tovar Time-out!

Source: virustotal.com

Source: blackhat.com

Library of SpartaTom Cross, David Raymond, Greg Conti

Wednesday, August 5th at 10:15am

Source: justice.gov

• YOUR FAVORITE SEARCH ENGINE!• Process Monitor (SysInternals)• Wireshark• Inetsim (via Remnux)• IDA Pro (alt. IDA shareware, radare, Hopper, objdump)

• OpenSecurityTraining.info• Practical Malware Analysis (Michael Sikorski and Andrew Honig)• The IDA Pro Book (Chris Eagle)

<shamelessPlug>• http://lancope.com/blog• https://twitter.com/stealth_labs• https://twitter.com/lancope</shamelessPlug>

Want to learn more?

THANK YOU

Brandon TanseySecurity Researcherbtansey@lancope.com

reverse engineering malware: a look inside operation tovar

rights r

malware analysis

victim computers source

malware loads

malware leaves

reverse engineering

c2 server

static analysis

Technology

malware-analyse und reverse engineering€¦ · analyse des...

reverse engineering malware workshop

reverse engineering malware · 2013. 1. 10. · sri...

reverse engineering mac malware - digital forensics … ·...

«introduction to malware reverse engineering» by sergey...

reversing malware analysis training part5 reverse...

christian wojner, cert - first · wh01am 02.04.2013 2...

malware-analyse und reverse engineering · malware-analyse...

teaching android mobile...

malware, reverse code engineering and cyber threat

threat hunting & ir - sans institute...threat hunting & ir...

tripoux: reverse-engineering of malware packers for...

malware reverse e ngineering

reverse malware

revenge is a dish served cold: debug-oriented malware...

reverse engineering malware part 1

android security and reverse engineering · • android and...

malware reverse engineering (class)

malware detection using machine learning … › 4b09 ›...

sri international reverse engineering malware hassen saidi...