Download pptx - Reverse Engineering Malware: A look inside Operation Tovar

1

Reverse Engineering Malware: A look inside Operation TovarBrandon TanseySecurity Researcher, Lancope

© 2014 Lancope, Inc. All rights reserved.

2© 2014 Lancope, Inc. All rights reserved.

Source: 2014 Verizon DBIR


75% of malware contained functionality of spyware/keyloggers

55% of malware automatically collected pre-existing data on victim computers

Source: 2013 Verizon DBIR


All malware leaves behind some information of its own


Malware Analysis

6

• Command and control hosts• Encryption keys• Implementation flaws• Exploits• Malware capabilities• …


What information is there to find?


What information do you need?




Dynamic Analysis vs. Static Analysis


Initialization1. Start the malware


Initialization1. Start the malware

2. Malware loads RSAenh.dll (Microsoft Enhanced Cryptographic Provider)


Establishing Persistence3. Copy self to Application Data


Establishing Persistence3. Copy self to Application Data

4. Open second process


Establishing Persistence5. Maintain auto-start registry keys


Reaching Out6. Make network calls


Reaching Out6. Make network calls

7. Start looking for command and control hosts



Establish C2

8. Find valid C2 host


Compromise9. Store public key


Compromise9. Store public key

10. Scan and encrypt files



Close loop11. Log encrypted files and start over


25

• Takes advantage of advanced public key crypto– RSAenh.dll– PublicKey registry key

• Loops through DNS requests for tons of gibberish hosts until it finds active, real one– All samples appear to create the same domains

• Does not begin encrypting until it receives public key from C2 server


What do we think we know?


Static Analysis





Source: microsoft.com








Source: justice.gov


Operation Tovar


Source: justice.gov


Operational Security(OPSEC)

Source: archive.gov


Source: justice.gov


“In cooperation with Luxembourg law enforcement agencies, pursuant to an

MLAT request, the FBI analyzed the contents of [second level Cryptolocker]

server, discovering HTTP access logs that showed which users were accessing this

server.”

Source: justice.gov


“This consistent pattern of overlapping IP addresses and user agent strings establishes

that Bogachev was the individual utilizing and managing the [Gameover] infrastructure.

Moreover, the fact that Bogachev had elevated Administrative access to the critical UK GOZ

server establishes that he is not only a participant in the GOZ conspiracy, but a

leader.” Source: justice.gov


Source: justice.gov


Tovar Time-out!


Source: virustotal.com


Source: blackhat.com

Library of SpartaTom Cross, David Raymond, Greg Conti

Wednesday, August 5th at 10:15am


Source: justice.gov


Source: justice.gov


Source: justice.gov



53

• YOUR FAVORITE SEARCH ENGINE!• Process Monitor (SysInternals)• Wireshark• Inetsim (via Remnux)• IDA Pro (alt. IDA shareware, radare, Hopper, objdump)


Tools

54

• OpenSecurityTraining.info• Practical Malware Analysis (Michael Sikorski and Andrew Honig)• The IDA Pro Book (Chris Eagle)

<shamelessPlug>• http://lancope.com/blog• https://twitter.com/stealth_labs• https://twitter.com/lancope</shamelessPlug>


Want to learn more?

55

THANK YOU


Brandon TanseySecurity [email protected]
