Genetic Malware
•
0 likes•760 views
Our hope is that defenders and reverse engineers can make use of the project updates to validate their preparedness and techniques against highly targeted malware. As discussed in our presentation, detection of malicious code in runtime interpreted languages is error prone and difficult. Shortly after our initial presentation at INFILTRATE, Kaspersky created an AV signature that flagged as malicious many of the most popular GO language applications such as Docker, a Bitcoin wallet and the actual Golang installer in an attempt to flag EBOWLA binaries – oops. We’ve updated the project to include a new loader for PowerShell. This ubiquitous Windows scripting language is widely used in offensive testing and by defenders for incident response. Now the incident responder will need to be proficient in PowerShell debugging to begin the task of decrypting targeted malware that could also end up being more PowerShell! Post-Ekoparty, the team is working on a traditional loader using C++ compiled code, so stay tuned and visit our EBOWLA GitHub page for future updates.
Recommended
Recommended
More Related Content
What's hot
What's hot (16)
Viewers also liked
Similar to Genetic Malware
Similar to Genetic Malware (20)
Recently uploaded
Recently uploaded (20)
Genetic Malware
- 1. Genetic Malware Designing payloads for specific targets @midnite_runr @wired33 Ekoparty 2016
- 2. Who we are • Travis Morrow • AppSec, Mobile, WebTesting, SecOps • Josh Pitts • Author of BDF/BDFProxy • https://github.com/secretsquirrel • AppSec, RedTeaming, WebTesting, SecOPs
- 3. How we got here…
- 9. Dude, I have this algo…
- 14. If you write Malware you have four enemies (besides LE)
- 15. If you write Malware you have four enemies (besides LE) If you write Malware you have four enemies (besides LE) Conduct Operations ^
- 18. • Including Consumer Grade Products • Founded by the Charlie Sheen of our industry • Easy to bypass, not really a concern • Can make you more vulnerable • Respect for F-Secure and Kaspersky AntI-VIR U S
- 19. • Including Consumer Grade Products • Founded by the Charlie Sheen of our industry • Easy to bypass, not really a concern • Can make you more vulnerable • Respect for F-Secure and Kaspersky AntI-VIR U S
- 20. However…
- 28. • Easy to bypass analysis • A lot of machines are still XP • They often: • Have unique ENV vars • Rarely change external IP • Have analysis timeouts Autom ated SAN D BO X
- 29. • Easy to bypass analysis • A lot of machines are still XP • They often: • Have unique ENV vars • Rarely change external IP • Have analysis timeouts Autom ated SAN D BO X
- 30. • Hard to defeat the Reverse Engineer (RE) • Tricks that defeat AV and Automated Sandboxes != work on an experienced RE • If malware payloads decrypt in memory on the RE’s machine, it can be analyzed • At best you can only slow down the RE • Turn RE into a password cracker and you win Reverse ENG INEER
- 31. • Kind of a MMO of Whack-A-Mole • Magnifies the outcome of easy to fingerprint malware • Defeat the RE and this becomes less effective C row dsourcing Info Sharing
- 32. • Kind of a MMO of Whack-A-Mole • Magnifies the outcome of easy to fingerprint malware • Defeat the RE and this becomes less effective C row dsourcing Info Sharing
- 34. Enter Environmental Keying … a short primer
- 35. Clueless Agents • Environmental Key Generation towards Clueless Agents (1998) - J. Riordan, B. Schneier • Several methods for key sources: • Server required • Usenet • Web pages • (Forward|Backwards)-Time Hash Function • Host specific • Mail messages • File System • Local network
- 36. Clueless Agents • Environmental Key Generation towards Clueless Agents (1998) - J. Riordan, B. Schneier • Several methods for key sources: • Server required • Usenet • Web pages • (Forward|Backwards)-Time Hash Function • Host specific • Mail messages • File System • Local network NO POC
- 37. Secure Triggers • Foundations for Secure Triggers (2003), Corelabs • Did not reference Clueless Agents • Defeat REs and analysis • Makes mention of OTP • Lots of Math (too much)
- 38. Secure Triggers • Foundations for Secure Triggers (2003), Corelabs • Did not reference Clueless Agents • Defeat REs and analysis • Makes mention of OTP • Lots of Math (too much) NO POC
- 39. Bradley Virus • Strong Cryptography Armoured Computer Virus Forbidding Code Analysis (2004), Eric Filiol • References Clueless Agents • Nested encrypted enclaves/payloads • “Complete source code is not available” • “[…]cause great concern among the antiviral community. This is the reason why will not give any detailed code.
- 40. Bradley Virus • Strong Cryptography Armoured Computer Virus Forbidding Code Analysis (2004), Eric Filiol • References Clueless Agents • Nested encrypted enclaves/payloads • “Complete source code is not available” • “[…]cause great concern among the antiviral community. This is the reason why will not give any detailed code.NO POC
- 41. Hash and Decrypt • Mesh design pattern: hash-and-decrypt (2007), Nate Lawson • Application of secure triggers to gaming
- 42. Hash and Decrypt • Mesh design pattern: hash-and-decrypt (2007), Nate Lawson • Application of secure triggers to gaming NO POC
- 43. Über-Malware • Malicious Cryptography… Reloaded (CanSecWest 2008) - E.Filiol, F.Raynal • New: Plausible Deniability! • Via OTP • POC was a XOR
- 44. Über-Malware • Malicious Cryptography… Reloaded (CanSecWest 2008) - E.Filiol, F.Raynal • New: Plausible Deniability! • Via OTP • POC was a XOR NO POC
- 45. Impeding Automation • Impeding Automated Malware Analysis with Environmental- sensitive Malware (2012), Usenix,(C.Song, et al) • Did not reference Clueless Agents or the Bradley Virus • Rediscovers Environmental Keying.. • Examples of Environmental keys • Great Quotes: • “Due to time constraints..” • “[…]exceeds the scope of this paper,[…] • “At the inception of this paper, concerns were raised[…]”
- 46. Impeding Automation • Impeding Automated Malware Analysis with Environmental- sensitive Malware (2012), Usenix,(C.Song, et al) • Did not reference Clueless Agents or the Bradley Virus • Rediscovers Environmental Keying.. • Examples of Environmental keys • Great Quotes: • “Due to time constraints..” • “[…]exceeds the scope of this paper,[…] • “At the inception of this paper, concerns were raised[…]” NO POC
- 47. Researchers have not released an open source environmental keying POC
- 48. Flashback (2011)
- 49. Flashback (2011) • Mac OS X only malware • Initial agent sent back UUID of OS to server • Server used MD5 of UUID to encrypt payload • Sent back to user and deployed
- 50. Gauss (2012)
- 51. Gauss (2012) • Discovered by Kaspersky • Encrypted Payload “Godel” • Key derived from directory path in program files, MD5 hashed for 10k rounds • Not publicly decrypted to date
- 54. Targeted Malware Compared to Biological/ Chemical Agents
- 56. Chemical Agents • Area effect weapons • Effective for days to weeks • For targeting systems: • Domain specific env vars • External IP address • Check system time
- 57. Biological Agents • Viral • Genetic Targeting • “Ethnic Weapons” • For systems targeting: • Path • Particular file (OTP) • See Jacob Torrey’s Work at HITB 2016 on PUFs (https:// conference.hitb.org/hitbsecconf2016ams/wp-content/ uploads/2015/11/D1T1-Jacob-Torrey-Using-the-Observer- Effect-and-Cyber-Fengshui.pdf)
- 58. Targeted Malware and its use in Operations
- 61. Hidden Command and Control (C&C)
- 65. Hidden C&C
- 69. Hidden C&C
- 75. Could you imagine a world where all malware was targeted?
- 80. E.B.O.W.L.A.
- 81. Ethnic BiO Weapon Limited Access E.B.O.W.L.A.
- 84. E.B.O.W.L.A.
- 85. E.B.O.W.L.A. }
- 86. E.B.O.W.L.A. }
- 87. Framework
- 88. Framework
- 89. Framework
- 90. Framework
- 91. Framework
- 92. Framework
- 95. Key Derivation: Environmental Factors Supported Environmentals • Environment Variables (e.g. %TEMP%, %USERNAME%, %TEMP%, etc) • File System Path (e.g. C:windowstemp ) • External IP Range (e.g. 100.10.0.0, 100.0.0.0) • Time Trigger (e.g. 20160401)
- 96. Encryption: payload_hash = sha512(payload[:-offset_bytes]) key = ((sha512(token1+token2+…)) * Iterations)[:32] enc_blob = base64(zlib*(iv+AES.CFB(key,iv,payload))) Key Derivation: Environmental Factors
- 97. Decryption: 1) Retrieve environment variables 2) Traverse File System from StartingPoint 3) Combine into all possible combinations and decrypt ** trial_key = sha512(token1 + token2 + …)* Iterations)[:32] ** if(sha512(decryptpayload(iv,enc_blob,trial_key[:-offset_bytes]) == payload_hash; continue Encryption: payload_hash = sha512(payload[:-offset_bytes]) key = ((sha512(token1+token2+…)) * Iterations)[:32] enc_blob = base64(zlib*(iv+AES.CFB(key,iv,payload))) Key Derivation: Environmental Factors
- 99. Encryption: payload_hash = sha512(payload[:-offset_bytes]) location = rand_location(uniq_key_file) key = ((sha512(read.location) * Iterations)[:32] enc_blob = base64(zlib*(location + lc.length + iv + AES.CFB(key,iv,payload))) Key Derivation: Unique File
- 100. Decryption: 1) Traverse File System from StartingPoint 2) Create a key from every file encountered & Attempt Decryption ** trial_key = sha512(readFile.location)* Iterations)[:32] ** if(sha512(decryptpayload(iv,enc_blob[22:],trial_key)[:- offset_bytes]) == payload_hash; continue Encryption: payload_hash = sha512(payload[:-offset_bytes]) location = rand_location(uniq_key_file) key = ((sha512(read.location) * Iterations)[:32] enc_blob = base64(zlib*(location + lc.length + iv + AES.CFB(key,iv,payload))) Key Derivation: Unique File
- 104. Key Derivation: One Time Pad (OTP)
- 105. Key Derivation: One Time Pad (OTP)
- 106. Pad Creation: 1) payload_hash = sha512(payload[:-offset_bytes]) 2) short_len = len(payload)*10% 3) payload_hash_short = sha512(payload)[:short_len] 4) lookup_table(uniqueBinary) = base64(zlib*([ [offset_loc][len],[offset_loc] [len], … ])) Key Derivation: One Time Pad (OTP)
- 107. Attacker Payload Target UniqueBinary Key Derivation: One Time Pad (OTP)
- 108. Attacker Payload Target UniqueBinary Lookup Table Key Derivation: One Time Pad (OTP)
- 109. Decryption: 1) Traverse File System from StartingPoint 2) Open Each file and build 10% 3) Validate 10% hash Matches then build entire payload ** if(sha512(rebuild_payload(lookup_table,current_file)[:- offset_bytes] == payload_hash; exec() Key Derivation: One Time Pad (OTP)
- 110. Issue Execution mechanism easily discovered in scripting languages Fix Protect the loader in Powershell and Python Execution Loader Protection
- 112. Outputs GO PythonPS
- 114. Input/Out Compatibility Payload Python GO PowerShell x64 x32 x64 x32 x64 x32 Reflective DLL In Memory In Memory In Memory In Memory DLL In Memory In Memory In Memory In Memory EXE On Disk On Disk In Memory In Memory In Memory In Memory ShellCode In Memory In Memory In Memory In Memory In Memory In Memory Python Code In Memory In Memory PowerShell Code In Memory FileDrop Supported In Progress Supported
- 115. Input/Out Compatibility Payload Python GO PowerShell x64 x32 x64 x32 x64 x32 Reflective DLL In Memory In Memory In Memory In Memory DLL In Memory In Memory In Memory In Memory EXE On Disk On Disk In Memory In Memory In Memory In Memory ShellCode In Memory In Memory In Memory In Memory In Memory In Memory Python Code In Memory In Memory PowerShell Code In Memory FileDrop Supported In Progress Supported
- 116. New PowerShell • Uses Invoke-ReflectivePEInjection for PE/DLL injection by Joe Bialek: @JosephBialek • Uses Invoke-Shellcode by Matt Graeber (@mattifestation)
- 117. Usage
- 118. $ ./ebowla.py payload config $ #Then compile output
- 119. The config file
- 120. Three Sections • Overall • OTP Settings • Symmetric Settings
- 121. Overall Section Encryption_Type OPTIONS: OTP ENV output_type OPTIONS: Python, GO, PowerShell payload_type OPTIONS for GO: EXE, DLL_x86, DLL_x64, SHELLCODE OPTIONS for PYTHON: EXE, SHELLCODE, CODE, FILE_DROP OPTIONS for PS: CODE, FILE_DROP, DLL_x86, DLL_x64, EXE, SHELLCODE key_iterations OPTIONS: Any number? Be reasonable.
- 122. Symmetric Key Settings This has four sections: • ENV_VARS • PATH • IP_RANGES • SYSTEM_TIME
- 123. Symmetric Key Settings ENV_VARS Can be anything, can add whatever you want if value is ‘’, it is not used. The value is used as a key. examples: username = ‘Administrator’ # Used homepath = ‘’ # Not used PATH path This is used as a key. OPTIONS: A full static path. start_loc Location to start looking for path match OPTIONS: Static location or Env variable (%PROGRAMFILES%)
- 124. Symmetric Key Settings IP_RANGES external_ip_mask Simple IP MASK, limited to /24 /16 /8 Example: 11.12.13.14, 11.12.13.0, 11.12.0.0, 11.0.0.0 SYSTEM_TIME Time_Range Limited to Year, Month, or DAY Format: YYYYMMDD Example: 20160401, 20160400, or 20160000
- 125. DEMO TIME
- 126. DEMO TIME
- 127. The Scenario • An American in Paris is low on Rubles • Wants Starcraft really bad • Answer: BitTorrent a cracked game! • Unfortunately the cracked starcraft games are patched with a backdoor targeting the most current version of BitTorrent
- 128. DEMO 1: OTP • Using BitTorrent.exe as the PAD • Version 7.9.5, Build 41866, 32bit • Meterpreter reverse https is the payload via a first stage DLL • Searching for the PAD starts in %APPDATA% • Code delivered through a backdoored/cracked game • Download and Execute payload
- 129. Torrent C&C DEMO 1: OTP
- 130. Torrent C&C 1. Cracked_game.exe DEMO 1: OTP
- 131. Torrent C&C 1. Cracked_game.exe 2. Ebowla_GO_payload.exe DEMO 1: OTP
- 132. Torrent C&C 1. Cracked_game.exe 2. Ebowla_GO_payload.exe 3. In memory Execution of a reverse https stage one payload as a DLL DEMO 1: OTP
- 133. Torrent C&C 1. Cracked_game.exe 2. Ebowla_GO_payload.exe 4. meterpreter.dll & C&C 3. In memory Execution of a reverse https stage one payload as a DLL DEMO 1: OTP
- 134. DEMO 2: Key from File • Using a location in BitTorrent.exe as the AES key source • Version 7.9.5, Build 41866, 32bit • Pupy EXE reverse https • Searching starts in %APPDATA% • Code delivered through a backdoored/cracked game • Download and Execute payload
- 135. Torrent C&C DEMO 2: Key from File
- 136. Torrent C&C 1. Cracked_game.exe DEMO 2: Key from File
- 137. Torrent C&C 1. Cracked_game.exe 2. Ebowla_GO_payload.exe DEMO 2: Key from File
- 138. Torrent C&C 1. Cracked_game.exe 2. Ebowla_GO_payload.exe 3. In memory execution the Pupy EXE DEMO 2: Key from File
- 139. Torrent C&C 1. Cracked_game.exe 2. Ebowla_GO_payload.exe Pupy C&C 3. In memory execution the Pupy EXE DEMO 2: Key from File
- 140. DEMO 3:Layered Payload • Using Environmental Factors • Stage 2: • Env Vars: Computer Name, number of processors as keys • GO EXE launching Pupy x64 DLL • Stage 1: • Using Date Range and IP Mask as keys • Python EXE, writes stage 1 to disk and Executes • Code delivered through a backdoored/cracked game • Download and Execute payload
- 141. Torrent C&C DEMO 3:Layered Payload
- 142. Torrent C&C 1. Cracked_game.exe DEMO 3:Layered Payload
- 143. Torrent C&C 1. Cracked_game.exe 2. Ebowla_multilayer_payload.exe DEMO 3:Layered Payload
- 144. Torrent C&C 1. Cracked_game.exe 2. Ebowla_multilayer_payload.exe 3. PyInstaller EXE => (disk)GO EXE => (memory)Pupy DLL DEMO 3:Layered Payload
- 145. Torrent C&C 1. Cracked_game.exe 2. Ebowla_multilayer_payload.exe Pupy C&C 3. PyInstaller EXE => (disk)GO EXE => (memory)Pupy DLL DEMO 3:Layered Payload
- 146. DEMO 4: Powershell Deploy Empire via powershell
- 147. Known Issues/Bugs • Chaining payloads: • GO EXE launching GO via Memory Module - DIE IN A FIRE • Pyinstaller EXE launching Pyinstaller EXE FROM DISK - Loses namespace • GO (memory module) -> Pyinstaller - Just no… • Metasploit x86 PE EXE template does not work with MemoryModule • OTP: • MZ/DOS Header Leak
- 148. This is OK • Go EXE • PyInstaller EXE • Chaining PyInstaller EXE -> GO EXE
- 149. Roadmap • C++ loaders - In Progress • Additional execution modules • Better chaining of payloads • OSX/Linux Support