Upload File

reverse engineering malware: a look inside operation tovar

  • Home
  • Technology
  • Reverse Engineering Malware: A look inside Operation Tovar
56
Reverse Engineering Malware: A look inside Operation Tovar Brandon Tansey Security Researcher, Lancope © 2014 Lancope, Inc. All rights reserved. 1

Upload: lancope-inc

Post on 15-Jan-2015

740 views

Category:

Technology


1 download

Report

Tags:

DESCRIPTION

Join us as we step through the reverse engineering of CryptoLocker, identifying important functionality and weaknesses. We'll demonstrate how we were able to use this information to help protect our customers months ago, the weaknesses that the Department of Justice took advantage of, and how you can do the same for other types of malware down the line.

TRANSCRIPT

Page 1: Reverse Engineering Malware: A look inside Operation Tovar

1

Reverse Engineering Malware: A look inside Operation TovarBrandon TanseySecurity Researcher, Lancope

© 2014 Lancope, Inc. All rights reserved.

Page 2: Reverse Engineering Malware: A look inside Operation Tovar

2© 2014 Lancope, Inc. All rights reserved.

Source: 2014 Verizon DBIR

Page 3: Reverse Engineering Malware: A look inside Operation Tovar

3© 2014 Lancope, Inc. All rights reserved.

75% of malware contained functionality of spyware/keyloggers

55% of malware automatically collected pre-existing data on victim computers

Source: 2013 Verizon DBIR

Page 4: Reverse Engineering Malware: A look inside Operation Tovar

4© 2014 Lancope, Inc. All rights reserved.

All malware leaves behind some information of its own

Page 5: Reverse Engineering Malware: A look inside Operation Tovar

5© 2014 Lancope, Inc. All rights reserved.

Malware Analysis

Page 6: Reverse Engineering Malware: A look inside Operation Tovar

6

• Command and control hosts• Encryption keys• Implementation flaws• Exploits• Malware capabilities• …

© 2014 Lancope, Inc. All rights reserved.

What information is there to find?

Page 7: Reverse Engineering Malware: A look inside Operation Tovar

7© 2014 Lancope, Inc. All rights reserved.

What information do you need?

Page 8: Reverse Engineering Malware: A look inside Operation Tovar

8© 2014 Lancope, Inc. All rights reserved.

Page 9: Reverse Engineering Malware: A look inside Operation Tovar

9© 2014 Lancope, Inc. All rights reserved.

Page 10: Reverse Engineering Malware: A look inside Operation Tovar

10© 2014 Lancope, Inc. All rights reserved.

Dynamic Analysis vs. Static Analysis

Page 11: Reverse Engineering Malware: A look inside Operation Tovar

11© 2014 Lancope, Inc. All rights reserved.

Initialization1. Start the malware

Page 12: Reverse Engineering Malware: A look inside Operation Tovar

12© 2014 Lancope, Inc. All rights reserved.

Initialization1. Start the malware

2. Malware loads RSAenh.dll (Microsoft Enhanced Cryptographic Provider)

Page 13: Reverse Engineering Malware: A look inside Operation Tovar

13© 2014 Lancope, Inc. All rights reserved.

Establishing Persistence3. Copy self to Application Data

Page 14: Reverse Engineering Malware: A look inside Operation Tovar

14© 2014 Lancope, Inc. All rights reserved.

Establishing Persistence3. Copy self to Application Data

4. Open second process

Page 15: Reverse Engineering Malware: A look inside Operation Tovar

15© 2014 Lancope, Inc. All rights reserved.

Establishing Persistence5. Maintain auto-start registry keys

Page 16: Reverse Engineering Malware: A look inside Operation Tovar

16© 2014 Lancope, Inc. All rights reserved.

Reaching Out6. Make network calls

Page 17: Reverse Engineering Malware: A look inside Operation Tovar

17© 2014 Lancope, Inc. All rights reserved.

Reaching Out6. Make network calls

7. Start looking for command and control hosts

Page 18: Reverse Engineering Malware: A look inside Operation Tovar

18© 2014 Lancope, Inc. All rights reserved.

Page 19: Reverse Engineering Malware: A look inside Operation Tovar

19© 2014 Lancope, Inc. All rights reserved.

Establish C2

8. Find valid C2 host

Page 20: Reverse Engineering Malware: A look inside Operation Tovar

20© 2014 Lancope, Inc. All rights reserved.

Compromise9. Store public key

Page 21: Reverse Engineering Malware: A look inside Operation Tovar

21© 2014 Lancope, Inc. All rights reserved.

Compromise9. Store public key

10. Scan and encrypt files

Page 22: Reverse Engineering Malware: A look inside Operation Tovar

22© 2014 Lancope, Inc. All rights reserved.

Page 23: Reverse Engineering Malware: A look inside Operation Tovar

23© 2014 Lancope, Inc. All rights reserved.

Close loop11. Log encrypted files and start over

Page 24: Reverse Engineering Malware: A look inside Operation Tovar

24© 2014 Lancope, Inc. All rights reserved.

Page 25: Reverse Engineering Malware: A look inside Operation Tovar

25

• Takes advantage of advanced public key crypto– RSAenh.dll– PublicKey registry key

• Loops through DNS requests for tons of gibberish hosts until it finds active, real one– All samples appear to create the same domains

• Does not begin encrypting until it receives public key from C2 server

© 2014 Lancope, Inc. All rights reserved.

What do we think we know?

Page 26: Reverse Engineering Malware: A look inside Operation Tovar

26© 2014 Lancope, Inc. All rights reserved.

Static Analysis

Page 27: Reverse Engineering Malware: A look inside Operation Tovar

27© 2014 Lancope, Inc. All rights reserved.

Page 28: Reverse Engineering Malware: A look inside Operation Tovar

28© 2014 Lancope, Inc. All rights reserved.

Page 29: Reverse Engineering Malware: A look inside Operation Tovar

29© 2014 Lancope, Inc. All rights reserved.

Page 30: Reverse Engineering Malware: A look inside Operation Tovar

30© 2014 Lancope, Inc. All rights reserved.

Source: microsoft.com

Page 31: Reverse Engineering Malware: A look inside Operation Tovar

31© 2014 Lancope, Inc. All rights reserved.

Page 32: Reverse Engineering Malware: A look inside Operation Tovar

32© 2014 Lancope, Inc. All rights reserved.

Page 33: Reverse Engineering Malware: A look inside Operation Tovar

33© 2014 Lancope, Inc. All rights reserved.

Page 34: Reverse Engineering Malware: A look inside Operation Tovar

34© 2014 Lancope, Inc. All rights reserved.

Page 35: Reverse Engineering Malware: A look inside Operation Tovar

35© 2014 Lancope, Inc. All rights reserved.

Page 36: Reverse Engineering Malware: A look inside Operation Tovar

36© 2014 Lancope, Inc. All rights reserved.

Page 37: Reverse Engineering Malware: A look inside Operation Tovar

37© 2014 Lancope, Inc. All rights reserved.

Source: justice.gov

Page 38: Reverse Engineering Malware: A look inside Operation Tovar

38© 2014 Lancope, Inc. All rights reserved.

Operation Tovar

Page 39: Reverse Engineering Malware: A look inside Operation Tovar

39© 2014 Lancope, Inc. All rights reserved.

Source: justice.gov

Page 40: Reverse Engineering Malware: A look inside Operation Tovar

40© 2014 Lancope, Inc. All rights reserved.

Operational Security(OPSEC)

Source: archive.gov

Page 41: Reverse Engineering Malware: A look inside Operation Tovar

41© 2014 Lancope, Inc. All rights reserved.

Source: justice.gov

Page 42: Reverse Engineering Malware: A look inside Operation Tovar

42© 2014 Lancope, Inc. All rights reserved.

“In cooperation with Luxembourg law enforcement agencies, pursuant to an

MLAT request, the FBI analyzed the contents of [second level Cryptolocker]

server, discovering HTTP access logs that showed which users were accessing this

server.”

Source: justice.gov

Page 43: Reverse Engineering Malware: A look inside Operation Tovar

43© 2014 Lancope, Inc. All rights reserved.

“This consistent pattern of overlapping IP addresses and user agent strings establishes

that Bogachev was the individual utilizing and managing the [Gameover] infrastructure.

Moreover, the fact that Bogachev had elevated Administrative access to the critical UK GOZ

server establishes that he is not only a participant in the GOZ conspiracy, but a

leader.” Source: justice.gov

Page 44: Reverse Engineering Malware: A look inside Operation Tovar

44© 2014 Lancope, Inc. All rights reserved.

Source: justice.gov

Page 45: Reverse Engineering Malware: A look inside Operation Tovar

45© 2014 Lancope, Inc. All rights reserved.

Tovar Time-out!

Page 46: Reverse Engineering Malware: A look inside Operation Tovar

46© 2014 Lancope, Inc. All rights reserved.

Source: virustotal.com

Page 47: Reverse Engineering Malware: A look inside Operation Tovar

47© 2014 Lancope, Inc. All rights reserved.

Source: blackhat.com

Library of SpartaTom Cross, David Raymond, Greg Conti

Wednesday, August 5th at 10:15am

Page 48: Reverse Engineering Malware: A look inside Operation Tovar

48© 2014 Lancope, Inc. All rights reserved.

Source: justice.gov

Page 49: Reverse Engineering Malware: A look inside Operation Tovar

49© 2014 Lancope, Inc. All rights reserved.

Source: justice.gov

Page 50: Reverse Engineering Malware: A look inside Operation Tovar

50© 2014 Lancope, Inc. All rights reserved.

Source: justice.gov

Page 51: Reverse Engineering Malware: A look inside Operation Tovar

51© 2014 Lancope, Inc. All rights reserved.

Page 52: Reverse Engineering Malware: A look inside Operation Tovar

52© 2014 Lancope, Inc. All rights reserved.

Page 53: Reverse Engineering Malware: A look inside Operation Tovar

53

• YOUR FAVORITE SEARCH ENGINE!• Process Monitor (SysInternals)• Wireshark• Inetsim (via Remnux)• IDA Pro (alt. IDA shareware, radare, Hopper, objdump)

© 2014 Lancope, Inc. All rights reserved.

Tools

Page 54: Reverse Engineering Malware: A look inside Operation Tovar

54

• OpenSecurityTraining.info• Practical Malware Analysis (Michael Sikorski and Andrew Honig)• The IDA Pro Book (Chris Eagle)

<shamelessPlug>• http://lancope.com/blog• https://twitter.com/stealth_labs• https://twitter.com/lancope</shamelessPlug>

© 2014 Lancope, Inc. All rights reserved.

Want to learn more?

Page 55: Reverse Engineering Malware: A look inside Operation Tovar

55

THANK YOU

© 2014 Lancope, Inc. All rights reserved.

Brandon TanseySecurity [email protected]

Page 56: Reverse Engineering Malware: A look inside Operation Tovar

56© 2014 Lancope, Inc. All rights reserved.


Reverse Engineering & Malware Analysis Engineering... · Reverse Engineering & Malware Analysis ... aren't making any changes to their security in 2017” - Barkly, ... Linux.ProxyM

Malware, Reverse Code Engineering and Cyber Threat

Malware Reverse E ngineering

RevEngE is a dish served cold: Debug-Oriented Malware … · 2019. 12. 12. · as malware re-engineering. We also introduce RevEngE1—the Reverse Engineering Engine for malware decompilation

Reversing & malware analysis training part 5 reverse engineering tools basics

Reverse Engineering Mac Malware - Digital Forensics … · Reverse Engineering Mac Malware SANS DFIR Summit 06/09/14 Sarah Edwards @iamevltwin mac4n6.com

Reversing malware analysis training part5 reverse engineering tools basics

Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Malware Reverse Engineering (Class)

Intrusion Detection and Malware Analysis · Intrusion Detection and Malware Analysis Course Introduction / Overview of Security Threats ... reverse engineering Stuxnet and understanding

NET MALWARE THREATS R · 2019-12-01 · Tools used to reverse and analyze .NET malware threats are completely different than ones used to reverse native language: dnSpy (excellent)

How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

Malware Reverse Engineering Part 1

Reverse Malware

Reverse Engineering Malware Workshop

Malware-Analyse und Reverse Engineering€¦ · Analyse des “Stoned”-Virus MARE 08 – Statische und dynamische Analysen zur Malware-Erkennung Bootsektor = „Master Boot Record“

Malware-Analyse und Reverse Engineering · Malware-Analyse und Reverse Engineering 13: Rückblick über das Semester 29.6.2017 Prof. Dr. Michael Engel. Überblick MARE 2017: • Einführungund

Teaching Android Mobile Securitypeople.rennes.inria.fr/Jean-Francois.Lalande/talks/... · Applications DEV app development MAL malware reverse PROJ AOSP classes BANK banking app reverse

Tripoux: Reverse-engineering of malware packers for dummies · 2010-11-26 · Tripoux: Reverse-engineering of malware packers for dummies - DeepSec 2010 10 •Common packed binaries

Automatic Reverse Engineering of Malware Emulators

Introduction to Malware Detection and Reverse Engineering

Windows for Reverse Engineers OS Internals · Windows for Reverse Engineers OS Internals CS-E4330 - Special Course in Information Security Reverse Engineering Malware Course 2017

© SERG Reverse Engineering (Reversing Malware) Reversing Malware [based on material from the textbook]

«Introduction to malware reverse engineering» by Sergey Kharyuk

Android Security and Reverse Engineering · • Android and Malware Basics – Os Elements – Application Structure – Malware Basics ... • Dalvikcode is obtained through a conversion

Malware-Analyse und Reverse Engineeringmulticores.org/teaching/files/MARE_03-Laufzeit.pdf · Malware-Analyse und Reverse Engineering 3: Laufzeit! 30.3.2017 Prof. Dr. Michael Engel

Reverse Engineering Malware Dynamic Analysis of Binary Malware · Title: T-110.6220: Using Debuggers to Analyze Malware Author: Tikkanen Antti Created Date: 2/14/2014 10:49:53 AM

Reverse Engineering Mac Malware - SANS · PDF fileReverse Engineering Mac Malware SANS DFIR Summit ... Mobile, Malware, ... General Forensics Nerd & Mac Fan Girl

Reverse Engineering Malware · 2013. 1. 10. · SRI International Reverse Engineering Malware Hassen Saidi Computer Science Laboratory SRI International [email protected]. The

SRI International Reverse Engineering Malware Hassen Saidi Computer Science Laboratory SRI International [email protected]

Introduction to Reverse Engineering · Protecting the irreplaceable | f-secure.com Introduction to Reverse Engineering Gergely Erdélyi – Senior Manager, Anti-malware Research

Course Introduction & Logistics · 2013. 6. 25. · Reverse Engineering Malware, Spring 2013 Antti Tikkanen, F-Secure Corporation Course Introduction & Logistics . Reverse Engineering

Christian Wojner, CERT - FIRST · Wh01am 02.04.2013 2 Person Christian Wojner Malware Analysis, Reverse Engineering, Computer Forensics CERT.at / GovCERT.gv.at Papers Mass Malware

Threat Hunting & IR - SANS Institute...Threat Hunting & IR Summit & Training 2019 October 2-7 | #ThreatHuntingSummit @sansforensics Venue ... FOR610 Reverse-Engineering Malware: Malware

Reverse Engineering Mac Malware - SANS Information ... · Reverse Engineering Mac Malware ... Office Document ZIP Archive ... • ^Reverse Engineering OS X _ - reverse.put.as (@osxreverser)