Anúncio

[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama

CODE BLUE
CODE BLUE
1 de Jan de 2023••
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama
[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama

Check these out next

Introduction to ARM big.LITTLE technology
Introduction to ARM big.LITTLE technology
義洋 顏
What are latest new features that DPDK brings into 2018?
What are latest new features that DPDK brings into 2018?
Michelle Holley
Linux BPF Superpowers
Linux BPF Superpowers
Brendan Gregg
eBPF/XDP
eBPF/XDP
Netronome
Linux 4.x Tracing: Performance Analysis with bcc/BPF
Linux 4.x Tracing: Performance Analysis with bcc/BPF
Brendan Gregg
Parallel Replication in MySQL and MariaDB
Parallel Replication in MySQL and MariaDB
Mydbops
Must Read HP Data Protector Interview Questions
Must Read HP Data Protector Interview Questions
Laxman J
DPDK In Depth
DPDK In Depth
Kernel TLV
1 de 59

[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama

1 de Jan de 2023••
Baixar para ler offline
Apresentações e oratória

Malware analysts normally obtain IP addresses of the malware's command & control (C2) servers by analyzing samples. This approach works in commoditized attacks or campaigns. However, with targeted attacks using APT malware, it's difficult to acquire a sufficient number of samples for organizations other than antivirus companies. As a result, malware C2 IOCs collected by a single organization are just the tip of the iceberg. For years, I have reversed the C2 protocols of high-profile APT malware families then discovered the active C2 servers on the Internet by emulating the protocols. In this presentation, I will explain how to emulate the protocols of two long-term pieces of malware used by PRC-linked cyber espionage threat actors: Winnti 4.0 and ShadowPad. Both pieces of malware support multiple C2 protocols like TCP/TLS/HTTP/HTTPS/UDP. It's also common to have different data formats and encoding algorithms per each protocol in one piece of malware. I'll cover the protocol details while referring to unique functions such as server-mode in Winnti 4.0 and multiple protocol listening at a single port in ShadowPad. Additionally, I'll share the findings regarding the Internet-wide C2 scanning and its limitations. After the presentation, I'll publish over 140 C2 IOCs with the date ranges in which they were discovered. These dates are more helpful than just IP address information since the C2s are typically found on hosted servers, meaning that the C2 could sometimes exist on a specific IP only for a very limited time. 65% of these IOCs have 0 detection on VirusTotal as of the time of this writing.

CODE BLUE
CODE BLUE
Anúncio
Anúncio
Anúncio

Recomendados

[cb22] CloudDragon’s Credential Factory is Powering Up Its Espionage Activiti...[cb22] CloudDragon’s Credential Factory is Powering Up Its Espionage Activiti...
[cb22] CloudDragon’s Credential Factory is Powering Up Its Espionage Activiti...CODE BLUE39 visualizações•60 slides
[cb22] Hayabusa Threat Hunting and Fast Forensics in Windows environments fo...[cb22] Hayabusa Threat Hunting and Fast Forensics in Windows environments fo...
[cb22] Hayabusa Threat Hunting and Fast Forensics in Windows environments fo...CODE BLUE168 visualizações•72 slides
Understanding DPDKUnderstanding DPDK
Understanding DPDKDenys Haryachyy100.9K visualizações•42 slides
XPDDS19 Keynote: Xen Dom0-less - Stefano Stabellini, Principal Engineer, XilinxXPDDS19 Keynote: Xen Dom0-less - Stefano Stabellini, Principal Engineer, Xilinx
XPDDS19 Keynote: Xen Dom0-less - Stefano Stabellini, Principal Engineer, XilinxThe Linux Foundation5.2K visualizações•23 slides
introduction to linux kernel tcp/ip ptocotol stack introduction to linux kernel tcp/ip ptocotol stack
introduction to linux kernel tcp/ip ptocotol stack monad bobo12.8K visualizações•16 slides
BPF: Tracing and moreBPF: Tracing and more
BPF: Tracing and moreBrendan Gregg200.1K visualizações•72 slides

Mais conteúdo relacionado

Apresentações para você(20)

Introduction to ARM big.LITTLE technologyIntroduction to ARM big.LITTLE technology
Introduction to ARM big.LITTLE technology
義洋 顏•740 visualizações
What are latest new features that DPDK brings into 2018?What are latest new features that DPDK brings into 2018?
What are latest new features that DPDK brings into 2018?
Michelle Holley•2.1K visualizações
Linux BPF SuperpowersLinux BPF Superpowers
Linux BPF Superpowers
Brendan Gregg•409.6K visualizações
eBPF/XDP eBPF/XDP
eBPF/XDP
Netronome•3.2K visualizações
Linux 4.x Tracing: Performance Analysis with bcc/BPFLinux 4.x Tracing: Performance Analysis with bcc/BPF
Linux 4.x Tracing: Performance Analysis with bcc/BPF
Brendan Gregg•10.7K visualizações
Parallel Replication in MySQL and MariaDBParallel Replication in MySQL and MariaDB
Parallel Replication in MySQL and MariaDB
Mydbops•736 visualizações
Must Read HP Data Protector Interview QuestionsMust Read HP Data Protector Interview Questions
Must Read HP Data Protector Interview Questions
Laxman J•5.5K visualizações
DPDK In DepthDPDK In Depth
DPDK In Depth
Kernel TLV•5K visualizações
Megastore by GoogleMegastore by Google
Megastore by Google
Ankita Kapratwar•2.9K visualizações
Syslog ProtocolsSyslog Protocols
Syslog Protocols
Martin Schütte•3.9K visualizações
Xen in Safety-Critical Systems - Critical Summit 2022Xen in Safety-Critical Systems - Critical Summit 2022
Xen in Safety-Critical Systems - Critical Summit 2022
Stefano Stabellini•281 visualizações
eBPF maps 101eBPF maps 101
eBPF maps 101
SUSE Labs Taipei•4.1K visualizações
Securing Java EE apps using WildFly ElytronSecuring Java EE apps using WildFly Elytron
Securing Java EE apps using WildFly Elytron
Jan Kalina•4.7K visualizações
Cilium - Container Networking with BPF & XDPCilium - Container Networking with BPF & XDP
Cilium - Container Networking with BPF & XDP
Thomas Graf•4.7K visualizações
Derbycon - The Unintended Risks of Trusting Active DirectoryDerbycon - The Unintended Risks of Trusting Active Directory
Derbycon - The Unintended Risks of Trusting Active Directory
Will Schroeder•34K visualizações
Avaya VoIP on Cisco Best Practices by PacketBaseAvaya VoIP on Cisco Best Practices by PacketBase
Avaya VoIP on Cisco Best Practices by PacketBase
PacketBase, Inc.•62.1K visualizações
ONOS SDN Controller - IntroductionONOS SDN Controller - Introduction
ONOS SDN Controller - Introduction
Eueung Mulyana•2.8K visualizações
Linux-wpan: IEEE 802.15.4 and 6LoWPAN in the Linux Kernel - BUD17-120Linux-wpan: IEEE 802.15.4 and 6LoWPAN in the Linux Kernel - BUD17-120
Linux-wpan: IEEE 802.15.4 and 6LoWPAN in the Linux Kernel - BUD17-120
Linaro•4.8K visualizações
Authentication TechnologiesAuthentication Technologies
Authentication Technologies
Nicholas Davis•4.7K visualizações
IBM Datapower Security Scenario with JWS & JWEIBM Datapower Security Scenario with JWS & JWE
IBM Datapower Security Scenario with JWS & JWE
sandipg123•183 visualizações

Similar a [cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama(20)

Microsoft Offical Course 20410C_05Microsoft Offical Course 20410C_05
Microsoft Offical Course 20410C_05
gameaxt•1.7K visualizações
Your app lives on the network - networking for web developersYour app lives on the network - networking for web developers
Your app lives on the network - networking for web developers
Wim Godden•474 visualizações
用Raspberry Pi 學Linux I2C Driver用Raspberry Pi 學Linux I2C Driver
用Raspberry Pi 學Linux I2C Driver
艾鍗科技•42.6K visualizações
Opentalk at Large - StS 2005Opentalk at Large - StS 2005
Opentalk at Large - StS 2005
Martin Kobetic•476 visualizações
Stu t17 aStu t17 a
Stu t17 a
SelectedPresentations•387 visualizações
Nessus scan report using the defualt scan policy - Tareq HanayshaNessus scan report using the defualt scan policy - Tareq Hanaysha
Nessus scan report using the defualt scan policy - Tareq Hanaysha
Hanaysha•1.9K visualizações
Information Theft: Wireless Router Shareport for Phun and profit - Hero Suhar...Information Theft: Wireless Router Shareport for Phun and profit - Hero Suhar...
Information Theft: Wireless Router Shareport for Phun and profit - Hero Suhar...
idsecconf•611 visualizações
05 module managing your network enviornment05 module managing your network enviornment
05 module managing your network enviornment
Asif•209 visualizações
[cb22] Fight Against Malware Development Life Cycle by Shusei Tomonaga and Yu...[cb22] Fight Against Malware Development Life Cycle by Shusei Tomonaga and Yu...
[cb22] Fight Against Malware Development Life Cycle by Shusei Tomonaga and Yu...
CODE BLUE•36 visualizações
Positive Hack Days. Sklyarov. Vulnerabilities in the Systems of Authenticity ...Positive Hack Days. Sklyarov. Vulnerabilities in the Systems of Authenticity ...
Positive Hack Days. Sklyarov. Vulnerabilities in the Systems of Authenticity ...
Positive Hack Days•859 visualizações
Networking labNetworking lab
Networking lab
Ragu Ram•11.4K visualizações
IMS Authentication with AKAv1 and AKAv2 IMS Authentication with AKAv1 and AKAv2
IMS Authentication with AKAv1 and AKAv2
mohammad norozzudegan•517 visualizações
Lab telematicosLab telematicos
Lab telematicos
León Velarde•287 visualizações
Lab telematicosLab telematicos
Lab telematicos
León Velarde•183 visualizações
4.1.1.10 Packet Tracer - Configuring Extended ACLs Scenario 1.pdf4.1.1.10 Packet Tracer - Configuring Extended ACLs Scenario 1.pdf
4.1.1.10 Packet Tracer - Configuring Extended ACLs Scenario 1.pdf
ssuserf7cd2b•25 visualizações
4.1.1.10 packet tracer configuring extended ac ls scenario 14.1.1.10 packet tracer configuring extended ac ls scenario 1
4.1.1.10 packet tracer configuring extended ac ls scenario 1
mps125•404 visualizações
Client serverClient server
Client server
maryam1231•310 visualizações
Positive Hack Days. Скляров. Уязвимости систем контроля подлинности цифровых ...Positive Hack Days. Скляров. Уязвимости систем контроля подлинности цифровых ...
Positive Hack Days. Скляров. Уязвимости систем контроля подлинности цифровых ...
Positive Hack Days•1.3K visualizações
Quic illustratedQuic illustrated
Quic illustrated
Alexander Krizhanovsky•1.3K visualizações
A New Framework for DetectionA New Framework for Detection
A New Framework for Detection
Sourcefire VRT•519 visualizações
Anúncio

Mais de CODE BLUE(20)

[cb22] Tales of 5G hacking by Karsten Nohl[cb22] Tales of 5G hacking by Karsten Nohl
[cb22] Tales of 5G hacking by Karsten Nohl
CODE BLUE•49 visualizações
[cb22] Your Printer is not your Printer ! - Hacking Printers at Pwn2Own by A...[cb22] Your Printer is not your Printer ! - Hacking Printers at Pwn2Own by A...
[cb22] Your Printer is not your Printer ! - Hacking Printers at Pwn2Own by A...
CODE BLUE•25 visualizações
[cb22] "The Present and Future of Coordinated Vulnerability Disclosure" Inter...[cb22] "The Present and Future of Coordinated Vulnerability Disclosure" Inter...
[cb22] "The Present and Future of Coordinated Vulnerability Disclosure" Inter...
CODE BLUE•11 visualizações
[cb22] 「協調された脆弱性開示の現在と未来」国際的なパネルディスカッション（4） by 板橋 博之[cb22] 「協調された脆弱性開示の現在と未来」国際的なパネルディスカッション（4） by 板橋 博之
[cb22] 「協調された脆弱性開示の現在と未来」国際的なパネルディスカッション（4） by 板橋 博之
CODE BLUE•22 visualizações
[cb22] "The Present and Future of Coordinated Vulnerability Disclosure" Inter...[cb22] "The Present and Future of Coordinated Vulnerability Disclosure" Inter...
[cb22] "The Present and Future of Coordinated Vulnerability Disclosure" Inter...
CODE BLUE•20 visualizações
[cb22] 「協調された脆弱性開示の現在と未来」国際的なパネルディスカッション（3） by Lorenzo Pupillo[cb22] 「協調された脆弱性開示の現在と未来」国際的なパネルディスカッション（3） by Lorenzo Pupillo
[cb22] 「協調された脆弱性開示の現在と未来」国際的なパネルディスカッション（3） by Lorenzo Pupillo
CODE BLUE•9 visualizações
[cb22] ”The Present and Future of Coordinated Vulnerability Disclosure” Inte...[cb22] ”The Present and Future of Coordinated Vulnerability Disclosure” Inte...
[cb22] ”The Present and Future of Coordinated Vulnerability Disclosure” Inte...
CODE BLUE•9 visualizações
[cb22] 「協調された脆弱性開示の現在と未来」国際的なパネルディスカッション（2）by Allan Friedman [cb22] 「協調された脆弱性開示の現在と未来」国際的なパネルディスカッション（2）by Allan Friedman
[cb22] 「協調された脆弱性開示の現在と未来」国際的なパネルディスカッション（2）by Allan Friedman
CODE BLUE•18 visualizações
[cb22] "The Present and Future of Coordinated Vulnerability Disclosure" Inter...[cb22] "The Present and Future of Coordinated Vulnerability Disclosure" Inter...
[cb22] "The Present and Future of Coordinated Vulnerability Disclosure" Inter...
CODE BLUE•8 visualizações
[cb22] 「協調された脆弱性開示の現在と未来」国際的なパネルディスカッション （1）by 高橋 郁夫[cb22] 「協調された脆弱性開示の現在と未来」国際的なパネルディスカッション （1）by 高橋 郁夫
[cb22] 「協調された脆弱性開示の現在と未来」国際的なパネルディスカッション （1）by 高橋 郁夫
CODE BLUE•25 visualizações
[cb22] Are Embedded Devices Ready for ROP Attacks? -ROP verification for low-...[cb22] Are Embedded Devices Ready for ROP Attacks? -ROP verification for low-...
[cb22] Are Embedded Devices Ready for ROP Attacks? -ROP verification for low-...
CODE BLUE•19 visualizações
[cb22] Wslinkのマルチレイヤーな仮想環境について by Vladislav Hrčka [cb22] Wslinkのマルチレイヤーな仮想環境について by Vladislav Hrčka
[cb22] Wslinkのマルチレイヤーな仮想環境について by Vladislav Hrčka
CODE BLUE•23 visualizações
[cb22] Under the hood of Wslink’s multilayered virtual machine en by Vladisla...[cb22] Under the hood of Wslink’s multilayered virtual machine en by Vladisla...
[cb22] Under the hood of Wslink’s multilayered virtual machine en by Vladisla...
CODE BLUE•6 visualizações
[cb22] From Parroting to Echoing: The Evolution of China’s Bots-Driven Info...[cb22] From Parroting to Echoing: The Evolution of China’s Bots-Driven Info...
[cb22] From Parroting to Echoing: The Evolution of China’s Bots-Driven Info...
CODE BLUE•22 visualizações
[cb22] Who is the Mal-Gopher? - Implementation and Evaluation of “gimpfuzzy”...[cb22] Who is the Mal-Gopher? - Implementation and Evaluation of “gimpfuzzy”...
[cb22] Who is the Mal-Gopher? - Implementation and Evaluation of “gimpfuzzy”...
CODE BLUE•7 visualizações
[cb22] Mal-gopherとは？Go系マルウェアの分類のためのgimpfuzzy実装と評価 by 澤部 祐太, 甘粕 伸幸, 野村 和也[cb22] Mal-gopherとは？Go系マルウェアの分類のためのgimpfuzzy実装と評価 by 澤部 祐太, 甘粕 伸幸, 野村 和也
[cb22] Mal-gopherとは？Go系マルウェアの分類のためのgimpfuzzy実装と評価 by 澤部 祐太, 甘粕 伸幸, 野村 和也
CODE BLUE•110 visualizações
[cb22] What I learned from the direct confrontation with the adversaries who ...[cb22] What I learned from the direct confrontation with the adversaries who ...
[cb22] What I learned from the direct confrontation with the adversaries who ...
CODE BLUE•5 visualizações
[cb22] ブロックチェーンにC&Cサーバー情報を隠ぺいした攻撃者との直接対峙により得られたもの by 谷口 剛[cb22] ブロックチェーンにC&Cサーバー情報を隠ぺいした攻撃者との直接対峙により得られたもの by 谷口 剛
[cb22] ブロックチェーンにC&Cサーバー情報を隠ぺいした攻撃者との直接対峙により得られたもの by 谷口 剛
CODE BLUE•61 visualizações
[cb22] SMARTIAN: Enhancing Smart Contract Fuzzing with Static and Dynamic Da...[cb22] SMARTIAN: Enhancing Smart Contract Fuzzing with Static and Dynamic Da...
[cb22] SMARTIAN: Enhancing Smart Contract Fuzzing with Static and Dynamic Da...
CODE BLUE•30 visualizações
[cb22] Red light in the factory - From 0 to 100 OT adversary emulation by Vi...[cb22] Red light in the factory - From 0 to 100 OT adversary emulation by Vi...
[cb22] Red light in the factory - From 0 to 100 OT adversary emulation by Vi...
CODE BLUE•37 visualizações

Último(20)

해외카지노 【www,rt33,top】코드 b77 콩고 공화국 배당률 Ợ 마카오국가 Ⅰ 아마존슬롯 🤤 ucl베팅 ┒ 프로그레시브슬롯 Ց 프로...해외카지노 【www,rt33,top】코드 b77 콩고 공화국 배당률 Ợ 마카오국가 Ⅰ 아마존슬롯 🤤 ucl베팅 ┒ 프로그레시브슬롯 Ց 프로...
해외카지노 【www,rt33,top】코드 b77 콩고 공화국 배당률 Ợ 마카오국가 Ⅰ 아마존슬롯 🤤 ucl베팅 ┒ 프로그레시브슬롯 Ց 프로...
1xBet 원엑스벳•16 visualizações
CHARISMATIC LEADERSHIP.pdfCHARISMATIC LEADERSHIP.pdf
CHARISMATIC LEADERSHIP.pdf
ZaynabAwan3•0 visão
留学英国必看：邓迪大学毕业证、学位证办理流程留学英国必看：邓迪大学毕业证、学位证办理流程
留学英国必看：邓迪大学毕业证、学位证办理流程
gugckf•3 visualizações
Presentation1 (1).pptxPresentation1 (1).pptx
Presentation1 (1).pptx
AdithyaPatel8•3 visualizações
最新1:1仿造威腾堡应用科技大学毕业证文凭最新1:1仿造威腾堡应用科技大学毕业证文凭
最新1:1仿造威腾堡应用科技大学毕业证文凭
pkunde•2 visualizações
motv.pdfmotv.pdf
motv.pdf
ArnestMada•36 visualizações
02_Layer2_Network_Design.ppt02_Layer2_Network_Design.ppt
02_Layer2_Network_Design.ppt
EnumulaBhargava1•1 visão
Krishi Saagar.pptxKrishi Saagar.pptx
Krishi Saagar.pptx
KarthikBhargav4•1 visão
presentation hospitality.pdfpresentation hospitality.pdf
presentation hospitality.pdf
PRIYANSHUSINGH566703•0 visão
THE TATA GROUP.pptxTHE TATA GROUP.pptx
THE TATA GROUP.pptx
KartikVashisht8•6 visualizações
cropsurvey-MasterTraining.pptxcropsurvey-MasterTraining.pptx
cropsurvey-MasterTraining.pptx
KRamakrishnan8•1 visão
tcpheader-151221111244.pdftcpheader-151221111244.pdf
tcpheader-151221111244.pdf
EnumulaBhargava1•1 visão
留学加拿大必看：圣托马斯大学毕业证、学位证办理流程留学加拿大必看：圣托马斯大学毕业证、学位证办理流程
留学加拿大必看：圣托马斯大学毕业证、学位证办理流程
yuazbb•2 visualizações
最新1:1仿造格林威治大学毕业证文凭最新1:1仿造格林威治大学毕业证文凭
最新1:1仿造格林威治大学毕业证文凭
pkunde•4 visualizações
Gloseije (Jessy) Bazolana- IOTFAGloseije (Jessy) Bazolana- IOTFA
Gloseije (Jessy) Bazolana- IOTFA
itnewsafrica•1 visão
SlideMembers_GrayTurquoiseOutlinesFreePPTTemplate_PS_1939.pptxSlideMembers_GrayTurquoiseOutlinesFreePPTTemplate_PS_1939.pptx
SlideMembers_GrayTurquoiseOutlinesFreePPTTemplate_PS_1939.pptx
niv_morsi•2 visualizações
Template Tema Digital Presentation.potxTemplate Tema Digital Presentation.potx
Template Tema Digital Presentation.potx
KevinAprillio2•2 visualizações
最新1:1仿造温尼伯大学毕业证文凭最新1:1仿造温尼伯大学毕业证文凭
最新1:1仿造温尼伯大学毕业证文凭
ueususw•3 visualizações
LANDMARKS AND MONUMENTS OF NIGERIALANDMARKS AND MONUMENTS OF NIGERIA
LANDMARKS AND MONUMENTS OF NIGERIA
Basil Achie•0 visão
Thesis | Research Paper | Defense Presentation | Technology Overuse | Mental ...Thesis | Research Paper | Defense Presentation | Technology Overuse | Mental ...
Thesis | Research Paper | Defense Presentation | Technology Overuse | Mental ...
MdKhalidSakib•0 visão
Anúncio

[cb22] Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning by Takahiro Haruyama

  1. Tracking the entire iceberg - long-term APT malware C2 protocol emulation and scanning
  2. Who am I? @cci_forensics Past Research CB 2022
  3. Motivation
  4. Overview CB 2022
  5. Target Summary Winnti 4.0 ShadowPad Prevalence Low High First-observed year 2016 (start-up sequence), 2018 (new C2 protocol) 2015 Scanning start year 2019 2021 Supported protocols TCP/TLS/HTTP(S)/ UDP TCP/SSL/HTTP(S)/ UDP/DNS Unique feature Server-mode Multiple protocol listening at a single port
  6. Winnti 4.0 CB 2022
  7. Winnti Malware Kaspersky Novetta CB 2022
  8. Winnti Malware 4.0 Macnica Networks version 4.0 CB 2022 Version 3.0 Version 4.0 Initial component Dropper Loader and DAT file Initial encryption algorithm DES AES Initial encryption key cracking Easy Hard Worker encryption 1-byte XOR and nibble swap DPAPI or AES with host- specific key
  9. Winnti Malware 4.0 (Cont.) CB 2022 struct struc_work_config { char campaignID[64]; char MAC_addr[6]; int c2_proto; // enum_proto ... } enum enum_proto { none = 0x0, TCP = 0x1, HTTP = 0x2, HTTPS = 0x3, TLS = 0x4, UDP = 0x5, };
  10. C2 Protocol CB 2022
  11. Packet Format CB 2022 struct struc_custom_header { __int16 temp_key_seed; __int16 unk_word; // initial value is 2 __int16 signature; // 0x45DB int payload_len; }; struct struc_custom_payload_init { int payload_type; // request:0xEE775BAA/0x4563CEFA/0x5633CBAD, response:0xFACEB007/0x5633CBAD int unk_dword; // request:0, response:0xC350/0xC352 GUID guid; char null_bytes[14]; __int16 seq_num; // starting from 1 __int16 null_word; };
  12. Encryption AppCall CB 2022
  13. HTTP Protocol CB 2022 Customized packet Customized packet size
  14. HTTP: Size Calculation from Cookie Value CB 2022 $ python validate_cookie.py 640ABEFB16D2CE36E7E83E1B8BEF31B2500ABEFB dw0=0xfbbe0a64, dw1=0x36ced216, dw2=0x1b3ee8e7, dw3=0xb231ef8b, dw4=0xfbbe0a50 The cookie value validated. dword key = 0x34
  15. HTTP: Dummy Data in GET Request CB 2022 Size = 0 Size = 0
  16. Behavior After the Initial Handshake CB 2022 struct struc_nested_payload // at least 0x14 bytes { // e.g., cmd_ID=5 & dispatch_ID=1 order to send victim info __int16 cmd_ID; __int16 dispatch_ID; ... int additional_data_len; struc_data_cmd1 additional_data; // flexible size }; struct struc_custom_payload_next { __int16 messageID; ... __int16 signature; // 0x45db int nested_payload_len; struc_nested_payload nested_payload; };
  17. Scanner Implementation CB 2022 ZMap • Internet-wide port scan • TCP 443 & 80 • UDP 443 & 53 (customized packet required) Stand-alone Python Script • HTTP(S): Decode and Validate Cookie value • Others: Get suspicious responses with the same size and different key IDAPython AppCall • Decrypt response’s customized packet • Validate signature and payload size in the header
  18. How to Differentiate Server-mode Infections and C2 Servers [DEBUG] server header: unknown word = 0x2, header signature = 0x45db, payload length = 0x2a [*] server payload: payload type = 0xfaceb007, unknown dword = 0xc352, GUID = 0b8212dc- e364-4c18-ac0b-26382beb1387, sequence number = 2 [DEBUG] server header: unknown word = 0x2, header signature = 0x45db, payload length = 0x2a [*] server payload: payload type = 0xfaceb007, unknown dword = 0x0, GUID = 00000000-0000- 0000-0000-000000000000, sequence number = 1 Server-mode: the same GUID as client, sequence number incremented C2: null GUID, sequence number reset CB 2022
  19. Result: Population by Protocol CB 2022 TLS 35% HTTPS 29% HTTP 20% TCP 11% UDP 5% TLS HTTPS HTTP TCP UDP
  20. 0 5 10 15 20 25 D e c - 1 9 F e b - 2 0 A p r - 2 0 J u n - 2 0 A u g - 2 0 O c t - 2 0 D e c - 2 0 F e b - 2 1 A p r - 2 1 J u n - 2 1 A u g - 2 1 O c t - 2 1 D e c - 2 1 F e b - 2 2 A p r - 2 2 J u n - 2 2 A u g - 2 2 number of active C2s period Result: Change in Number of Active C2s CB 2022 1st disclosure 2nd disclosure
  21. Public Reports Related to Winnti 4.0 C2s Trellix Recorded Future CB 2022
  22. ShadowPad CB 2022
  23. ShadowPad Malware SentinelOne CB 2022
  24. C2 Protocol TCP HTTP(S)/UDP Key size 4 2 Header size 0x14 8 Payload size in the initial handshake packet Up to 0x3F HTTP(S): Up to 0x1F, UDP: 0x10 CB 2022
  25. C2 Protocol (Cont.) CB 2022 Variant name C2 protocol Config size Attribution Source Variant1 (aka ScatterBee) TCP/UDP 0x896 APT41 Positive Technologies Variant2 HTTP(S) 0x85C Tonto Team ESET Variant3 HTTP(S) 0x85C unknown Positive Technologies
  26. TCP Protocol QuickLZ CB 2022 struct struc_common_header { int session_key; int plugin_and_cmd_id; // plugin_id (0x68) << 16 + cmd_id (0x51) byVariant1 int module_code; // 0 int payload_size_compressed; // QuickLZ int payload_size_original; };
  27. TCP Protocol (Cont.) Dr.WEB white paper CB 2022
  28. HTTP(S) and UDP Protocols CB 2022 struct struc_proto_header { __int16 session_key; __int16 type; // 0 in HTTP, req=0x1001/res=(0x2002|0x5005) in UDP __int16 session_src_id; // random 2 bytes, generated by both client/server __int16 session_dst_id; // req=0, res=client's session_src_id };
  29. HTTP(S) and UDP Protocols (Cont.) CB 2022 UDP packet encoding byVariant1 HTTP(S) packet encoding byVariant2 HTTP(S) packet encoding byVariant3
  30. HTTP(S) and UDP Protocols (Cont.) CB 2022 struc_proto_header payload = TCP packet struc_common_header QuickLZ-compressed payload
  31. Scanner Implementation CB 2022 Scanning start period Target protocol/port/variant September 2021 HTTP/443 (Variant2 &Variant3) October 2021 TCP/443 & UDP/53 (Variant1) June 2022 UDP/443 (Variant1), HTTP/80 (Variant3)
  32. Scanner Implementation (Cont.) CB 2022 ZMap • Internet-wide port scan • Targets as mentioned previously Stand-alone Python Script • Decode the response packet • Validate the decoded values • TCP: payload size fields • HTTP(S)/UDP: type and session_dst_id
  33. Multiple Protocol Listening at a Single Port CB 2022 [*] config size = 0x85c .. [+] C2 Entry 0 (offset 0xbc): 'HTTPS://wwa1we.wbew.amazon-corp.wikaba.com:443' [+] C2 Entry 1 (offset 0xed): 'HTTP://wwa1we.wbew.amazon-corp.wikaba.com:443' .. SHA256: d011130defd8b988ab78043b30a9f7e0cada5751064b3975a19f4de92d2c0025 Hostname/port matched
  34. Multiple Protocol Listening at a Single Port (Cont.) CB 2022 $ ./c2fs.py -d -l corpus/query.txt -p 443 -f sp httpVariant2 .. [*] malware options: family = ShadowPad; targeted protocol = http (version =Variant2) [*] ShadowPad specific options: version =Variant2; key size = 2; key endian = big; header size = 0x8; header type = 0x0; client session ID = 53978 [D] POST: http://137.220.185.203:443/ (proxy={}, stream=True, timeout=30) [+] 137.220.185.203,active,client session ID matched (type=0x0) .. $ ./c2fs.py -d -l corpus/query.txt -p 443 -f sp httpsVariant2 .. [*] malware options: family = ShadowPad; targeted protocol = https (version =Variant2) [*] ShadowPad specific options: version =Variant2; key size = 2; key endian = big; header size = 0x8; header type = 0x0; client session ID = 52256 [D] POST: https://137.220.185.203:443/ (proxy={}, stream=True, timeout=30) [+] 137.220.185.203,active,client session ID matched (type=0x0)
  35. Result: Population by Variant CB 2022 Variant1 48% Variant3 42% Variant2 10% Variant1 Variant3 Variant2
  36. 0 5 10 15 20 25 S e p - 2 1 O c t - 2 1 N o v - 2 1 D e c - 2 1 J a n - 2 2 F e b - 2 2 M a r - 2 2 A p r - 2 2 M a y - 2 2 J u n - 2 2 J u l - 2 2 A u g - 2 2 S e p - 2 2 number of active C2s period Result: Change in Number of Active C2s CB 2022 System issue New variant?
  37. Samples Communicating with C2 IPs CB 2022 Sample Malware family C2 IP address C2 Protocol/Port used by sample Sample submission date on VT C2 first-seen date by scanner C2 last-seen date by scanner Spyder 156.240.104.149 TLS/443 2021/10/26 2021/10/16 2021/10/16 ReverseWindow 43.129.188.223 TCP/10333 2022/02/27 2021/10/17 2022/10/04 ShadowPad 213.59.118.124 UDP/443 2022/03/20 2022/03/06 2022/09/27
  38. Spyder & Winnti 4.0: Code Similarity CB 2022 Spyder Winnti 4.0 Worker
  39. Spyder & Winnti 4.0: Command IDs CB 2022 Command Spyder Winnti 4.0Worker tag id cmd_ID dispatch_ID Verify the client 1 1 1 1 Send victim information 5 3 5 1 Send plugins information 6 1 6 9 or 13 Save plugin parameters 6 2 6 2 Save plugin data 6 3 6 3 Load and run plugin entrypoint and export function #1 6 4 6 6 Run plugin export function #4 and unload the plugin 6 5 6 7
  40. Spyder & Winnti 4.0: Command IDs (Cont.) CB 2022 Command Spyder Winnti 4.0Worker tag id cmd_ID dispatch_ID Heartbeat 6 6 6 8 Run plugin export function #2 6 7 6 10 Run plugin export function #3 6 8 6 11 Send current connection information 7 2 - (no command) - Run function pointer of the 2nd parameter obtained by running export function #1 11 - 11 -
  41. Spyder & Winnti 4.0: Comparison CB 2022 Spyder Winnti 4.0 Payload encoding / encryption single-byte XOR AES in CTR mode (key given as a cmdline argument) C2 Protocol TLS TCP/TLS/HTTP(S)/UDP Server-mode support No Yes 3rd-party library uthash, Mbed TLS uthash Reported year 2020 2019
  42. Incident Response Case Triggered by Discovered C2 CB 2022
  43. Notes for Internet-wide C2 Scanning CB 2022
  44. How to Get Input (Port Scan) Data scanning target ports CB 2022 ZMap Shodan CenSys TCP/10333 4,940,037 4 1,306 TCP/55555 3,199,856 86 486,497 Note: The data was collected in 2021/11
  45. Anonymization CB 2022 Tor Commercial VPN service Cost Free Non-free Supported protocols TCP TCP/UDP Risk of being blocked High Low
  46. Anonymization (Cont.) ZMap issue CB 2022
  47. Anti-Scanning Techniques: Cobalt Strike CB 2022
  48. Anti-Scanning Techniques: Cobalt Strike (Cont.) blocked CB 2022
  49. Anti-Scanning Techniques: ReverseWindow LuoYu’s ReverseWindow CB 2022
  50. Pros and Cons of Research Publication in Cobalt Strike Case JSAC 2021 CB 2022
  51. Research Publication Merits: Stopping MS Azure domain fronting stated CB 2022 Source: Exposing Malware in Linux-Based Multi-Cloud Environments
  52. Research Publication Merits: Stopping Ongoing Attack Campaign CB 2022 Source: Exposing Malware in Linux-Based Multi-Cloud Environments
  53. Research Publication Demerits: Developer’s Reaction CB 2022
  54. Research Publication Demerits: Threat Actor’s Reaction APT41 CB 2022 Protocol/Port Stager-disabled/Total in Sep 2021 Stager-disabled/Total in Jul 2022 HTTP/80 217/559 (38%) 208/387 (53%) HTTPS/443 210/928 (22%) 206/431 (47%) DNS/53 46/150 (30%) 51/51 (100%) Change in the result of a single scan
  55. Wrap-up CB 2022
  56. Wrap-up CB 2022
  57. Acknowledgement CB 2022
  58. Indicators of Compromise CB 2022 Indicator Type Context 0a3279bb86ff0de24c2a4b646f24ffa196ee639cc23c64a 044e20f50b93bda21 SHA256 Winnti 4.0 dat file 03b7b511716c074e9f6ef37318638337fd7449897be99 9505d4a3219572829b4 SHA256 ShadowPad Variant1 aef610b66b9efd1fa916a38f8ffea8b988c20c5deebf4db8 3b6be63f7ada2cc0 SHA256 ShadowPad Variant2 d011130defd8b988ab78043b30a9f7e0cada5751064b3 975a19f4de92d2c0025 SHA256 ShadowPad Variant3 1ded9878f8680e1d91354cbb5ad8a6960efd6ddca2da1 57eb4c1ef0f0430fd5f SHA256 Spyder communicating with the ShadowPad C2 (156.240.104.149) 536def339fefa0c259cf34f809393322cdece06fc4f2b37f 06136375b073dff3 SHA256 ReverseWindow communicating with the ShadowPad C2 (43.129.188.223) 9447b75af497e5a7f99f1ded1c1d87c53b5b59fce224a3 25932ad55eef9e0e4a SHA256 ShadowPad Variant1 communicating with the ShadowPad C2 (213.59.118.124)
  59. Questions? CB 2022
Anúncio