Upload File

marta janus malware researcher a tale of encounters with novel evasive malware

  • Home
  • Documents
  • Marta Janus Malware Researcher A tale of encounters with novel evasive malware
58
Marta Janus Malware Researcher Going gets tough A tale of encounters with novel evasive malware

Upload: michelle-chatfield

Post on 15-Dec-2015

216 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

Marta JanusMalware Researcher

Going gets tough

A tale of encounters with novel evasive malware

Page 2: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# whoami

• reverse engineering adept & enthusiast

• malware researcher @ KL since 2009• linux user since 2006• baldur’s gate player since 1999

Page 3: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

Are rootkits on decline?

Page 4: Marta Janus Malware Researcher A tale of encounters with novel evasive malware
Page 5: Marta Janus Malware Researcher A tale of encounters with novel evasive malware
Page 6: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

• kernel-space no longer safe for malware

• bootkits easily detected• hypervisor-level stealth too complex shift in malware strategy

Tough times for rootkits

Page 7: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

• hide from admin?• bypass detection• protect C&C infrastructure

• protect the payload

Hiding vs. evasion

the goals

Page 8: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

Case 1: Baldur

"When the going gets tough, someone hold my rodent!"

Page 9: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# Trojan.Win32.Baldur

• set of classical anti-vm / anti-dbg checks

• heavily based on a0rtega`s pafish• overly exciting? not really, but...• ...a textbook case :)

Page 10: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# classic_checks

Page 11: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# environmental_checks

WinSpy?

MBAM ?

???

Page 12: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# environmental_checks

Page 13: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# drive_size_check

Page 14: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# game_over

Page 15: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

Case 2: CVE-0158 & Gimemo

"Evil 'round every corner. Careful not to step in any."

Page 16: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# armed-to-the-teeth

http://www.securelist.com/en/analysis/204792298/The_curious_case_of_a_CVE_2012_0158_exploit

• multilayered OLE objects, lots of obfuscation• multi-stage shellcode:

~ stage_1: ROP chain~ stage_2: decryptor of stage_3~ stage_3: egg-hunter~ stage_4: dropper

Page 17: Marta Janus Malware Researcher A tale of encounters with novel evasive malware
Page 18: Marta Janus Malware Researcher A tale of encounters with novel evasive malware
Page 19: Marta Janus Malware Researcher A tale of encounters with novel evasive malware
Page 20: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# execute_payload

Page 21: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# payload: decrypt_loader

Page 22: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# skip_all_checks

Page 23: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# trigger_exception

Page 24: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# dummy_code

Page 25: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# seh_routine

Page 26: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# anti_hook, anti_bp

Page 27: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# anti_hook, anti_bp

Page 28: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# anti_hook, anti_bp: trampoline

Page 29: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# the dropper & the bot

Page 30: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

Case 3: PSW & more SEH

"No effect?! I need a bigger sword!"

Page 31: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# Trojan-PSW.Win32.Multi

• also spread via hardened CVE-0158 exploit

• also lots of anti-* techniques

• code flow of the loader fully based on exception handling blocks

• payload saved as a registry value

• overwrites fxsst.dll to assure persistance

Page 32: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# malware_main; seh chain

Page 33: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# exception_1

Page 34: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# exception_handler

Page 35: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# dormant_phase

Page 36: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# check_trend_micro

Page 37: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# exception_4

Page 38: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# decrypt_inject

Page 39: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

Case 4: hardened Zeus

"Fool me once, shame on you; fool me twice, watch it! I'm huge!"

Page 40: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# Trojan.Win32.Zbot

• samples from period of March – May 2014• use of windows messaging system• use of SEH• multiple downloaders

~ each with the same set of anti-* techniques

Page 41: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# load_cursor

Page 42: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# process_wndmsg

Page 43: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# seh_anti_debug

Page 44: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# seh_anti_debug

Page 45: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# enum_windows

Page 46: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

Case 5: even more hardened Zeus

"Boo says "WHAT?"

Page 47: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# ZeuS p2p aka Game Over

• works only on Windows 7

• anti-emulation based on default values in the CPU registers

• drops Necurs rootkit (!)

• bypasses driver signing via setting TESTSIGNING option in BCEDIT

Page 48: Marta Janus Malware Researcher A tale of encounters with novel evasive malware
Page 49: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# init_dialog

Page 50: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# obfuscated_win7_check

Page 51: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# obfuscated_win7_check

Page 52: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

# call_malware_main; step_17

Page 53: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

Novel malware architecture

• bypass detection

• protect C&C infrastructure

• protect the payload

the goals

anti-emu, anti-heur

multiple downloaders, waterholed websites

anti-re, anti-dbg, anti-vm, encryption, obfuscation, etc...

the aid

Page 54: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

loader

• packed, layered encryption, lots of anti-*• injects and executes the dropper code

dropper

• some encryption, some anti-*• decrypts and executes the downloader/bot code

bot

• small & simple, shellcode-like• used only to get/decrypt/run the payload(s)

payload

• downloaded from water-holed websites / pushed by C2• not stored on the disk, short-lived, controlled by C2

Page 55: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

• time or condition based triggers: ~ specified timeframes~ specified settings~ specified system events (e.g. reboot, mouse click, etc.)

• environmental checks:~ files on disk, running processes, loaded DLLs, opened

windows, mutexes, devices, registry settings.......

• checking initial values in CPU registers at EP~ fingerprinting the OS

Known evasion techniques

Page 56: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

• overrunning sandbox/emulator:~ dromant phase (e.g. sleep loops)~ junk instructions, slower inside VMs (MMX, FPU, etc.)~ benign code (legitimate looking syscalls)~ stalling code (without the use of syscalls)

• using window messaging, apc procedures, etc.

• using chained Exception Handling mechanisms

Known evasion techniques

Page 57: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

Countermeasures

stealth analysis leave no artifacts full emulation trace all instructions full exploration follow multiple execution

paths bypass stalling loops detect & skip passive

code

Page 58: Marta Janus Malware Researcher A tale of encounters with novel evasive malware

Thank You!

"We are all heroes: You and Boo and I"

marta.janus [at] kaspersky.com@mvjanus


JANUS CUP - Bioimpianti · 2019. 7. 5. · 2 CUPOLA JANUS IT EN ES JANUS CUP COPA JANUS La cupola bicentrica biarticolare JANUS CUP assicura vantaggi biomeccanici che manca-no nelle

VOTIRO FILE DISARMER SECURE DIGITAL ......SECURE DIGITAL TRANSFORMATION PREVENT NEXT-GEN EVASIVE ZERO-DAY EXPLOITS "When 30% of malware consists of zero-day threats - antivirus programs

JANUS et Cie / AMALFI€¦ · 800.24.janus +1 310 652 7090 janus et cie / amalfi

Threat Intelligence Spotlight: Hunting Evasive Malware...• Exploiting user behavior: tricking users into opening and executing a malicious file, going to a malicious site or handing

Full-System Emulation Achieving Successful Automated Dynamic Analysis of Evasive Malware — Christopher Kruegel at Black Hat 2014

[Whitepaper] Defeat Evasive Malware · sandbox technology or in the surrounding ecosystem to avoid detection. Evasion techniques that belong to this approach include hook circumvention,

Swiss Miss Returns - Enthused Enamoured Evasive

Minerva - Introduction to Evasive Techniques

Evasive Malware Exposed and Deconstructed - RSA … in Computer Science at UC Santa Barbara ... tricks in making code run that analysis system does not ... This idea has become more

FONDS professionell EQUITY & BALANCED FUNDS Janus Asia Fund Janus Balanced Fund Janus Emerging Markets Fund Janus Europe Fund Janus Global Growth Fund Janus Global Life Sciences Fund

Evasive Driving

Evasive Malware Exposed and Deconstructed - RSA … · Evasive Malware Exposed and Deconstructed Chief Scientist Lastline, Inc. CRWD-T08 . #RSAC Who am I? ... Also known as malware

Verifiably Robust Machine Learning For Security · Searching for Evasive PDF Malware •Attacks can be decomposed to building block operations •Feature insertion-only attacks. Grosse

This is DEEPerent: Tracking App behaviors with (Nothing ... · This is DEEPerent: Tracking App behaviors with (Nothing changed) phone for Evasive android malware

Memory Injection Prevention - Minerva Labs Assets... · Minerva offers a unique solution that prevents and mitigates memory injection attacks, stopping evasive malware and denying

0 - Evasive Driving Techniques

The Threat of Evasive Malware - Cloud Distribution · The Threat of Evasive Malware Lastline Labs ... Lastline relies on system emulation. With a system emulator, we gain the advantages

EVALUATION OF FIGHTER EVASIVE MANEUVERS AGAINST

Python and Malware: Developing Stealth and Evasive ... - arXiv

Lasorsa Defensive and Evasive Driving Certificate

Evasive Techniques: An IntroductionAT]minerva-labs.com 5 The Sum of All (Malware) Fears Classifying Malware's Phobias In order to better understand the usage of evasive techniques

ARTIM - Non Evasive Cure

Detecting Evasive Malware in Sandbox

What is Evasive Ad Content Policy

Now you see me, now you don't: chasing evasive malware - Giovanni Vigna

Obfuscation for Evasive Functions

Here’s the Titlecse498/2018-08/schedules/... · Beta Presentation Improved Detonation of Evasive Malware Department of Computer Science and Engineering Michigan State University

[Data Sheet] VMRay Analyzer - Secez › uploads › pdf › cyber › Malware-or... · the most evasive malware variants. Combined with the strengths of a built-in rapid reputation

Evasive Techniques: An Introduction - Amazon S3 · research[AT]minerva-labs.com 5 The Sum of All (Malware) Fears Classifying Malware's Phobias In order to better understand the usage

Webinar: Stopping evasive malware - how a cloud sandbox array works

Defensive and evasive ip strategies

Janus Henderson VIT Research Portfolio (formerly … · Janus Henderson VIT Research Portfolio (formerly named Janus Aspen Janus ... has so far taken a lightertouch ... Janus Henderson

Lastline Breach Detection Platform - Abbakan€¦ · malware behavior and is also the hardest for evasive malware to circumvent. The result is the successful detection of malicious

Understanding Evasive Script Tactics

Trust no file. Trust no device. - HCAhca.org.vn/userfiles/files/Tham luan VIO 2019/PANEL 05/3...Source: Evasive Malware Now a Commodity: Security Week, Siggi Stefnisson (2018) Percentage