Upload File

have you seen my malware?

23
Have You Seen My Malware? Joshua Pitts NovaHackers Nov 18, 2013

Upload: midniterunr

Post on 02-Nov-2014

890 views

Category:

Technology


1 download

Report

Tags:

DESCRIPTION

NovaHackers 11/2013 talk about the dangers of uploading malware to sandbox sites.

TRANSCRIPT

Page 1: Have You Seen My Malware?

Have You Seen My Malware?

Joshua PittsNovaHackersNov 18, 2013

Page 2: Have You Seen My Malware?

About Me

• Twitter: @midnite_runr• I work for Leviathan Security• Reverse Engineering, Pentesting

Page 3: Have You Seen My Malware?

Two Topics

• Recomposer• ??

Page 4: Have You Seen My Malware?

Submitting To VirusTotal

Who here uses VT?– At Home? – On Family’s computers? – At Work?

Page 5: Have You Seen My Malware?

The Dangers of VT

• VtNotify – By Mubix• Look up by hash• Easy for attackers to look up

Page 6: Have You Seen My Malware?

Recomposer

• Python• Win 32/64• Two functions:– PE Editor– Signature Modifier or re-composer

• github.com/secretsquirrel/recomposer

Page 7: Have You Seen My Malware?

Goal

Break the common signatures that enable malware to be easily tracked so we can once

again upload to online sandbox sites with less worry about being found out

Page 8: Have You Seen My Malware?

How?

• Randomly change:– File and sections names– Section flags

• For each code cave over 20 bytes: – Randomly pick one of five nops– Inject a random number of those into the cave

• For the most part the binary still functions normally

Page 9: Have You Seen My Malware?

Results

• Created 11,200 binaries from one binary• No collisions

Page 10: Have You Seen My Malware?

Ssdeep ResultsCompared to the original file:(77) 155(79) 9(80) 1662(82) 46(83) 5056(85) 3292(86) 15(88) 849(90) 2(91) 107(93) 6(94) 1• 1.0357 % of the files are >= 90%

Page 11: Have You Seen My Malware?

Ssdeep across all files

• 11200 * 11200 = 125,440,000 comparisons• Would take hours…• Let’s do >= 90%

Page 12: Have You Seen My Malware?

Comparison Results(100) 11200 : Expected(99) 0(98) 0(97) 0(96) 168(95) 0(94) 62(93) 7,604(92) 0(91) 216,384(90) 0Total 235,418• 125,204,582 additional comparisons that are below 90 % matching.

Page 13: Have You Seen My Malware?

Goal

Break the common signatures that enable malware to be easily tracked so we can once

again upload to online sandbox sites with less worry about being found out

GREAT SUCCESS!

Page 14: Have You Seen My Malware?

Part 1 Conclusion

You should feel better about using online sandbox sites now?

Right?

Page 15: Have You Seen My Malware?
Page 16: Have You Seen My Malware?

Part 2: My Malware went where?

When you upload binaries to online AV/malware sites:– Is it truly sandboxed?– Could an attacker tell if it was executed?– Can you track the sandboxes?

Page 17: Have You Seen My Malware?

Step 1: Make Malware

• Modified github.com/secretsquirrel/shellcode_retriever

• Each site had a unique URL (examples):– VT: herrovirus.html– Anibus: meow.html– Malwr.com: yawn.html

• Compile to binary with pyinstaller

Page 18: Have You Seen My Malware?

Step 2: Run Web Server

#!/usr/bin/env python

import BaseHTTPServerserver = BaseHTTPServer.HTTPServerserver_address = ("", 88)

class MyHandler(BaseHTTPServer.BaseHTTPRequestHandler): def address_string(self): return str(self.client_address[0])

httpd = server(server_address, MyHandler)httpd.serve_forever()

Page 19: Have You Seen My Malware?

Step 3: Upload

Selected Sandboxes:– Virustotal– Malwr– Threat– Jotti– Anibus– Garyshood– Virscan– ThreatTrack

Page 20: Have You Seen My Malware?

Responses

Sandbox: Total; Unique IPs; response on upload• Virustotal: 50; 10; yes• Jotti: 33; 10; yes• Malwr: 4; 3; yes• Anubis: 4; 3; yes• ThreatTrack: 1; yes• ThreatExperts: 0• Garyshood: 0• Virscan: 0

Page 21: Have You Seen My Malware?

Recognized IPs

• SourceFire• Amazon EC2• ThreatTrack• ThreatGrid• TOR• Kaspersky• Symantec

Page 22: Have You Seen My Malware?

Part 1 Conclusion

You should feel better about using online sandbox sites now?

Right?

Page 23: Have You Seen My Malware?

Questions?


ecriyAwarenee - ComplianceKIT€¦ · malware program so my computer doesn’t get infected. Behavior Change >> I will install anti-malware on all my devices—not just computers,

Hey, My Malware Knows Physics! Attacking PLCs with ... · Hey, My Malware Knows Physics! Attacking PLCs with Physical Model Aware Rootkit Luis A. Garcia Rutgers University [email protected]

Hacking Intranet Websites from the Outside E-book/EN... · embedded JavaScript malware. ‣Malware ads samy as their friend, updates their profile with “samy is my hero”, and

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

VIRUS/SPYWARE BASICS Botnets, Malware, Trojans oh my……

Have You Seen My Inbox? Government Oversteps the Fourth Amendment

BONUS - Shoestring Networks … · BONUS Removing Malware. worst malware infections. 4.It took me about 60 minutes (including ISO download time) to create my multi-boot USB. I included

My First Incident Response Team - smtps.net · My First Incident Response Team DFIR for Beginners ... Analyze APT malware with Cuckoo ... Cuckoo Sandbox

How My SVM nailed your Malware - OWASP My SVM nailed your Malware Implementing Machine Learning into Android Malware Analysis Nikhil P Kulkarni | @nikchillz

OVERVIEW Device Malware.pdf · Though mobile malware has been seen for virtually all mobile operating systems, the past several years has seen a surge in malware developed for Google’s

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Have You Seen My Henry Brown?

Metamorphic Malware 1 Metamorphic Malware Research

Malware report - Panda Security · 2020. 7. 14. · This malware first appeared in 2019: On 04/26/2019 it was first seen in attacks on several companies. Figure 2.2: Characteristics

SIM310. 1) “Malware Author’ grows BOTNET & makes available to “buyers” 2) Access is purchased via ‘MarketPlace’ 4) BOTNET attacks seen at multiple

HAVE YOU SEEN MY MISSUS. THE BLACK FLAG. · 2010-04-02 · HAVE YOU SEEN MY MISSUS. YOU'VE heard my children two Seeking for each other; My daughter left her home first, Soon followed

Have you seen my cat ppt online

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

PRONOUNS. Have you seen my dad? __’s wearing a red shirt

Have You Seen My Data? Auditing Data Governance - · PDF fileHave You Seen My Data? Auditing Data Governance Holger Reusch MBA, CFE, CISA Audit Advisor, University of Calgary Agenda

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Malware & Anti-Malware

PANAMA CITY - SEEN WITH MY "EYES"

Upgrading Your Android, Elevating My Malware: Privilege Escalation Through Mobile OS Updating

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Malware Viruses Ransomware. Can my computer be infected by just visiting certain websites in my windows browser? How can I be sure my computer and

The worst Ruby codes I’ve seen in my life - RubyKaigi 2015

How My SVM nailed your Malware - OWASP · Implementing Machine Learning into Android Malware Analysis Nikhil P Kulkarni | @nikchillz . whoami •Nikhil P Kulkarni •An active member

Upgrading Your Android, Elevating My Malware

Have You Seen My Cat

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

MALWARE: ANTI-FORENSICS - blackstormsecurity.com · Most of the time, code protected with VMProtect is seen in 64-bit malwares

How do I verify my site with Google Webmaster Tools after clearing my website of malware?

Has anyone seen my hat ?

My Call I’ve seen spring, I’ve seen fall, I’ve seen gate,