Botconf 2018

In the world of cryptocurrency-related malware, mining currencies based on cryptonote technology like Monero (XMR) is a growing threat for organizations. We can observe that interest in such cryptocurrencies has increased dramatically for malicious actors those past months because of the specificities of this technology. 

In this talk we will explain why such cryptocurrencies are appealing for malicious actors, and how to leverage publicly available sources for hunting of such related activities.

Over the past few weeks, we discovered the comeback of an APT attack against the Middle East, and specifically against the Palestinian Authority. 

The APT group behind this attack launched a campaign over a year ago, and very little of this operation was seen in the wild since. The renewed Big Bang campaign incorporates improved capabilities, wider functionalities, and a more offensive infrastructure. It also seems to have very specific targets in mind. 

Shared interests and malware features with campaigns belonging to the Gaza Cybergang that emerged in both 2017 and 2018 show that the infamous threat group is most likely behind this attack. 

Although the APT has gone through significant upgrades over the last year, the conductors maintained evident and peculiar fingerprints. Both the delivery methods and the malicious artifacts had unique traces which helped us link the current wave to past attacks. 

Among the techniques attributed to the APT group, one could find fake news websites containing up-to-date articles, well-formulated e-mails with malicious attachments or embedded links, and mobile applications posing as legitimate services. All of these methods are meant to filter-in targeted victims that meet predefined characteristics and lead to a custom-made reconnaissance malware. 

During our investigation, we were able to spot only three instances of the renewed operation, but distinctive characteristics in the command and control websites revealed a wider infrastructure that may serve unknown samples. While our analysis covered the capabilities of the malware, we are certain that this is a part of an ongoing multi-staged attack, the full infection chain of which has not been completed yet. 

The campaign earned its name due to the authors’ affection for the successful TV series “The Big Bang Theory” as reflected in their function naming standard. The malware code is decorated with the character names of the popular series, but also actors of the Turkish series “Resurrection: Ertugrul”. 

In our presentation we will cover the operation of this group, focusing on the recent improvements and tactics, as well as the techniques and procedures (TTPs) that identified this group both in previous attacks and in the current one.

At last year’s Botconf, we have launched Malpedia [1], our community-driven approach to create a free and independent resource for rapid identification and actionable context when investigating malware. While only touching the surface of analysis possibilities last time (mostly surveying PE header characteristics), we want to take a deep dive in this talk, showing the results of more than two years of ongoing in-depth analysis efforts. This time, the focus will be set on the unpacked representatives of more than 700 families of Windows malware. 

In the first part of this presentation, we will investigate the usage patterns of the Windows API as exposed by malware. For this, we extend ApiScout [2] with a method to extract API usage fingerprints. We will demonstrate how this information can be used to reliably identify and characterize malware families and that this information seems to capture habits of their respective authors to some degree. 

In the second part, we will introduce SMDA [3], a minimalist recursive disassembler library that is optimized for accurate Control Flow Graph (CFG) recovery from memory dumps. SMDA’s output allows us to create a function index, which can be used to identify similar code. On the one hand, we can use this similarity information to recognize and measure how commonly 3rd party libraries are used in malware. On the other hand, we can also isolate the unique, characteristic code for families in order to derive detection signatures for them. 

[1] https://malpedia.caad.fkie.fraunhofer.de 
[2] https://github.com/danielplohmann/apiscout 
[3] https://github.com/danielplohmann/smda  

We have seen a massive spike in malicious crypto mining campaigns killing themselves for the chance to have their victim’s CPU. The shorter and shorter time window between vulnerability disclosure and cryptojacking opportunistic attacks taking advantage of them may help us to understand how profitable they are to the point of getting priority over ransomware attacks. This article consists of a walk-through on a remarkable incident caused by an eager and clumsy attacker which ended up revealing multiple cryptojacking campaigns targeting large organizations across the world in early 2018.

Form-grabber malware are nowadays quite common. They provide simple yet effective methods for stealing infected users’ credentials. They are named thereby since they target HTML forms’ submissions, made by web-browsers. Sometimes, they also provide classical password stealer capabilities such as key-logging, or modules designed to take screenshots. Also, they can embed code for harvesting users applications’ passwords, stored on the file-system.

Formbook is a ‘ready-to-use’ form-grabber malware, sold illegally on hacking forums. Thus, it can be used by cyber-criminals who don’t necessary own skills in malware development, although it can still be used by more advanced actors. It comes with a PHP web-application, used to implement the C&C server. It also offers a panel, used to graphically manage infected computers, and visualize stolen data.

In order to evade anti-viruses detection, to detect automated malware analysis environments or to complicate its reverse-engineering, Formbook implements many tricks. It also uses interesting code injection techniques, based on APC injection and thread hijacking, to perform actions like process-creation, from within the context of legitimate windows processes such as explorer. Its ability to migrate from a 32-bit process, running in wow64 compatibility mode, to a native 64-bit process also makes it worth looking at.

Cloud computing provides scalable and on-demand infrastructure, which seems to be the perfect way to host a botnet. This paper focuses on cloud-based botnets to perform legal DDoS resilience tests. We model the cost of such botnets and provide both technical and economical insights into their usage for controlled DDoS attacks. While these purpose-built botnets appear to be more expensive than online DDoS booter services, they remain affordable in the context of legal audits.

Neutrino Bot (also known and detected as Win/Kasidet) is a rapidly changing threat. It first became known around December 2013. It has been actively developed ever since resulting in version 5.4 at the very beginning of 2018. From the early times, when the bot’s commands were focused on various DDoS attacks, it evolved into something quite different. Its current state allows to remotely execute commands, files, scan the infected system and both modify and monitor network traffic while keeping some of the old tricks as well.
In the talk, we would like to look at different versions of the bot and their specifics and describe the changes that are being made. We will also explain its current functionality and transition into a fully functional banking trojan.
The malware is affordable and relatively cheap which leads to many independent actors operating their botnets in a very different way. That said, it is much more interesting to learn what each group leverages the bot for rather than tracking it as a whole.
Identifying similar configurations is not always easy, but there are several ways to do so. We want to demonstrate the methods of how to detect which samples belong to each other in order to identify different botnets. We will show the botnets that have been discovered during the last year, what is typical for them, how do they use the bot and what have they delivered through it. We will also lighten the mood with several examples of situations, when operators failed to execute their malicious activities properly by utilizing wrong configuration or harmless webinjects.
No centralized distribution method is offered, that means every botnet operator has to distribute the bot on his own. The discovered methods include malvertising, trojanized installers or the Ammyy supply chain attack.

Bot malware landscape always changes with both new and old families being updated with new techniques to perform cybercrime. And due to their sheer number, manually analysing and tracking them is a tedious affair. This entails delayed response to the threat. Because of this, automated systems have become an integral part of malware research to learn more about these commonly on-and-off malware operations. Data obtained from these systems can be indispensable for planning and implementing counter moves against the threat. In this way, we can lessen the gap between threat discovery and mitigation. 

With the same motivation, we have conducted research on Trickbot family, which has become one of the most popular botnet families since its first discovery in 2016. It has evolved with new modules being added to its arsenal for spreading and stealing more information from its victims. Up to this day we are seeing new campaigns and modules being distributed in the wild. 
What got us really interested in this malware is its refined network behaviour and more importantly its wide variety of modules that it distributes to its victims. Its rotating C2 servers and by-command delivery of its modules make manual analysis and monitoring extremely tedious. We thought this is a good opportunity to create a tracker system to monitor the malware 
Trickbot’s infrastructure relies in its modular infection distributed via its own network protocol under TLS. This eventually became our entry point in gathering data from its own servers. 

In this presentation, we will discuss Trickbot’s behaviour. More importantly, we will also be focusing on the procedures we took to design and build the monitoring system including the challenges we encountered along the way. This will rely heavily on reverse engineering its network communication and how we were able to use its own protocol to obtain specific artefacts from its servers. 
As a result of the data we gathered, we will share statistics and the information generated from the tracker and how they can be used to help mitigate the threat automatically.

The connected societies facing ever evolving risks, traditional cyber security solutions have been charged by the popular jury for incompetence. Yet they are working for what they have been designed for, the rise of targeted attacks as well as the maturation of advanced cybercrime force defenders to find new ways of fighting the ghosts in the machines. Cyber Threat Intelligence has emerged for about a decade now, bringing new mind-set, tools and methods to the overall InfoSec community. After reminded what composed this activity, this conceptual presentation will focus on Tactical Threat Intelligence. By diagnosing that adversaries’ behaviour analysis has been mainly hijack to provide technical indicators and strategic feedback, we will review today’s methods and tools used
for cyber threat profiling and express the limitation or problematics they brought to Intelligence Tradecraft specialist. Moves by the impression that today’s Tactical Threat Intelligence is rarely as a say derived into action, we will finally explore new leads that could bring the discipline more operational concretisation and will help tactical analyst is the difficult path to automate tasks in a very psychological influenced domain.