Have You Seen My Malware?

Joshua PittsNovaHackersNov 18, 2013

About Me

• Twitter: @midnite_runr• I work for Leviathan Security• Reverse Engineering, Pentesting

Two Topics

• Recomposer• ??

Submitting To VirusTotal

Who here uses VT?– At Home? – On Family’s computers? – At Work?

The Dangers of VT

• VtNotify – By Mubix• Look up by hash• Easy for attackers to look up

Recomposer

• Python• Win 32/64• Two functions:– PE Editor– Signature Modifier or re-composer

• github.com/secretsquirrel/recomposer

Break the common signatures that enable malware to be easily tracked so we can once

again upload to online sandbox sites with less worry about being found out

• Randomly change:– File and sections names– Section flags

• For each code cave over 20 bytes: – Randomly pick one of five nops– Inject a random number of those into the cave

• For the most part the binary still functions normally

Results

• Created 11,200 binaries from one binary• No collisions

Ssdeep ResultsCompared to the original file:(77) 155(79) 9(80) 1662(82) 46(83) 5056(85) 3292(86) 15(88) 849(90) 2(91) 107(93) 6(94) 1• 1.0357 % of the files are >= 90%

Ssdeep across all files

• 11200 * 11200 = 125,440,000 comparisons• Would take hours…• Let’s do >= 90%

Comparison Results(100) 11200 : Expected(99) 0(98) 0(97) 0(96) 168(95) 0(94) 62(93) 7,604(92) 0(91) 216,384(90) 0Total 235,418• 125,204,582 additional comparisons that are below 90 % matching.

Break the common signatures that enable malware to be easily tracked so we can once

again upload to online sandbox sites with less worry about being found out

GREAT SUCCESS!

Part 1 Conclusion

You should feel better about using online sandbox sites now?

Right?

Part 2: My Malware went where?

When you upload binaries to online AV/malware sites:– Is it truly sandboxed?– Could an attacker tell if it was executed?– Can you track the sandboxes?

Step 1: Make Malware

• Modified github.com/secretsquirrel/shellcode_retriever

• Each site had a unique URL (examples):– VT: herrovirus.html– Anibus: meow.html– Malwr.com: yawn.html

• Compile to binary with pyinstaller

Step 2: Run Web Server

#!/usr/bin/env python

import BaseHTTPServerserver = BaseHTTPServer.HTTPServerserver_address = ("", 88)

class MyHandler(BaseHTTPServer.BaseHTTPRequestHandler): def address_string(self): return str(self.client_address[0])

httpd = server(server_address, MyHandler)httpd.serve_forever()

Step 3: Upload

Selected Sandboxes:– Virustotal– Malwr– Threat– Jotti– Anibus– Garyshood– Virscan– ThreatTrack

Responses

Sandbox: Total; Unique IPs; response on upload• Virustotal: 50; 10; yes• Jotti: 33; 10; yes• Malwr: 4; 3; yes• Anubis: 4; 3; yes• ThreatTrack: 1; yes• ThreatExperts: 0• Garyshood: 0• Virscan: 0

Recognized IPs

• SourceFire• Amazon EC2• ThreatTrack• ThreatGrid• TOR• Kaspersky• Symantec

Part 1 Conclusion

You should feel better about using online sandbox sites now?

Right?

Questions?

Have You Seen My Malware?

Technology

Transcript of Have You Seen My Malware?

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Trafﬁc Exchanges

Hacking Intranet Websites from the Outside E-book/EN... · embedded JavaScript malware. ‣Malware ads samy as their friend, updates their profile with “samy is my hero”, and

The worst Ruby codes I’ve seen in my life - RubyKaigi 2015

Doctor, my eyes have seen the light!

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab.

My First Incident Response Team - smtps.net · My First Incident Response Team DFIR for Beginners ... Analyze APT malware with Cuckoo ... Cuckoo Sandbox

Malware Viruses Ransomware. Can my computer be infected by just visiting certain websites in my windows browser? How can I be sure my computer and.

Have You Seen my Parachute: Jumping With Nothing at all.

Hey, My Malware Knows Physics! Attacking PLCs with ... · Hey, My Malware Knows Physics! Attacking PLCs with Physical Model Aware Rootkit Luis A. Garcia Rutgers University l.garcia2@rutgers.edu

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Have You Seen My Inbox? Government Oversteps the Fourth Amendment

OVERVIEW Device Malware.pdf · Though mobile malware has been seen for virtually all mobile operating systems, the past several years has seen a surge in malware developed for Google’s

Metamorphic Malware 1 Metamorphic Malware Research.

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

PRONOUNS. Have you seen my dad? __’s wearing a red shirt.

Upgrading Your Android, Elevating My Malware

Have You Seen My Data? Auditing Data Governance - · PDF fileHave You Seen My Data? Auditing Data Governance Holger Reusch MBA, CFE, CISA Audit Advisor, University of Calgary Agenda

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware