Top Banner
Intro to Reverse Engineering and Malware Analysis Jake Smith University of Virginia uu$$$$$$$$$$$uu uu$$$$$$$$$$$$$$$$$uu u$$$$$$$$$$$$$$$$$$$$$u u$$$$$$$$$$$$$$$$$$$$$$$u u$$$$$$$$$$$$$$$$$$$$$$$$$u u$$$$$$* *$$$* *$$$$$$u *$$$$* u$u $$$$* $$$u u$u u$$$ $$$u u$$$u u$$$ *$$$$uu$$$ $$$uu$$$$* *$$$$$$$* *$$$$$$$* u$$$$$$$u$$$$$$$u u$*$*$*$*$*$*$u uuu $$u$ $ $ $ $u$$ uuu u$$$$ $$$$$u$u$u$$$ u$$$$ $$$$$uu *$$$$$$$$$* uu$$$$$$ u$$$$$$$$$$$uu ***** uuuu$$$$$$$$$ $$$$***$$$$$$$$$$uuu uu$$$$$$$$$***$$$* *** **$$$$$$$$$$$uu **$*** uuuu **$$$$$$$$$$uuu u$$$uuu$$$$$$$$$uu **$$$$$$$$$$$uuu$$$ $$$$$$$$$$**** **$$$$$$$$$$$* *$$$$$* **$$$$** $$$* PRESS ANY KEY! $$$$* Credits: @MalwareUnicorn
28

Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Oct 26, 2019

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Intro to Reverse Engineering

and Malware Analysis

Jake Smith

University of Virginia

uu$$$$$$$$$$$uuuu$$$$$$$$$$$$$$$$$uuu$$$$$$$$$$$$$$$$$$$$$u

u$$$$$$$$$$$$$$$$$$$$$$$uu$$$$$$$$$$$$$$$$$$$$$$$$$uu$$$$$$* *$$$* *$$$$$$u*$$$$* u$u $$$$*$$$u u$u u$$$$$$u u$$$u u$$$*$$$$uu$$$ $$$uu$$$$**$$$$$$$* *$$$$$$$*

u$$$$$$$u$$$$$$$uu$*$*$*$*$*$*$u

uuu $$u$ $ $ $ $u$$ uuuu$$$$ $$$$$u$u$u$$$ u$$$$$$$$$uu *$$$$$$$$$* uu$$$$$$

u$$$$$$$$$$$uu ***** uuuu$$$$$$$$$$$$$***$$$$$$$$$$uuu uu$$$$$$$$$***$$$**** **$$$$$$$$$$$uu **$***

uuuu **$$$$$$$$$$uuuu$$$uuu$$$$$$$$$uu **$$$$$$$$$$$uuu$$$$$$$$$$$$$**** **$$$$$$$$$$$*

*$$$$$* **$$$$**$$$* PRESS ANY KEY! $$$$*

Credits:@MalwareUnicorn

Page 2: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

_.-`''`-._,` `. __________________________ | ,._-'''-. | | OPSEC is important || |,-. ,-.| | | Cybercriminals be hackin’||/'<o> <o>`-| < Security + Law + Ethics |\ (_) / `--------------------------'\ ____ /\ `--` /

_.--`/'|`-..-'|\''''`-.,-' / |`._,' / \ \

| / \,/``\/ \ | \| | '> |\,/| <' ,' \| `/^)\ |/`\| / / \/ / / \ | | / | \

/ / ,``, \ \ / / | \' | | \ \ / / |\_ \

/ ,| _.' \ | | |__...-'` | \/ / `. | |````` | \

| / ,`') | |\ || ,` ,/\ | _,:''`, |

---\,,.-'`---------| _/ ,` , \ ,'--gan----------

Cybersecurity News Segment

Page 3: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Agenda

• Overview• What

• Why/Context

• How

• Basic Analysis• File, Strings, VirusTotal

• Static Analysis• HxD, IDA

• Detection / YARA

Page 4: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Malware Types (What)

Virus

• “Classic” malware, runs malicious code

• User action required

Worm

• Self-propagating malware (ie exploit vuln, etc)

• Example: NotPetya

Trojan

• Pretends to be legitimate software

• Example: Phone App that also steals your info

Page 5: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Malware Types (What)

Ransomware

• Encrypts all files and demands ransom

• Example: WannaCry, (Not)Petya, TeslaCrypt

RAT/Backdoor

• Allows an attacker to have remote access to machine

• Example: Dark Comet

Dropper

• “Initial” stage of malware

• Downloads malicious Stage 2, and executes it

Page 6: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Malware Goals (Why)

Data

• Company IP

• Personally Identifiable

Information (PII)

Money

• Cryptocoins!

• Financial Info

Damage

• Destroy Facilities

• Cause Harm

Page 7: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Delivery and Techniques (How)

https://www.eventtracker.com/tech-articles/siemphonic-cyber-kill-chain/

https://www.eventtracker.com/tech-articles/siemphonic-cyber-kill-chain/
Page 8: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Delivery and Techniques (How)

• Obfuscation

https://sites.google.com/secured.org/malwareunicorn/reverse-engineering/re101/section-2?authuser=0

https://sites.google.com/secured.org/malwareunicorn/reverse-engineering/re101/section-2?authuser=0
Page 9: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Delivery and Techniques (How)

• Persistence

https://sites.google.com/secured.org/malwareunicorn/reverse-engineering/re101/section-2?authuser=0

https://sites.google.com/secured.org/malwareunicorn/reverse-engineering/re101/section-2?authuser=0
Page 10: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Delivery and Techniques (How)

• Credential Theft

https://www.blackhillsinfosec.com/your-password-is-wait-for-it-not-always-encrypted/

https://www.blackhillsinfosec.com/your-password-is-wait-for-it-not-always-encrypted/
Page 11: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Basic Analysis

Page 12: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

File Command

• Looks at “magic bytes” - first few bytes of file

• Compares byte sequence to see what type of file it is

• ELF = Executable and Linking Format

• Executable/ELF file:

• Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00

• Syntax: file <filename>

Page 13: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Note: Windows Subsystem

• Allows you to run Ubuntu and other linux without

needing a full VM

• Access your files at:

• cd /mnt/c/Users/<you>/

• Follow instructions at

https://tinyurl.com/installwsl to install

https://tinyurl.com/installwsl
Page 14: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

File Practice

• wget problems.metactf.com/cns/file1

• file file1

• Try downloading file2 and file3 to see what kind of

files they are

Page 15: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Strings Command

• Outputs all strings in the program/file

• Useful to see what you can deduce about program /

its contents

• Syntax: strings <filename>

Page 16: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Strings Practice

• Try running strings on the files from before

• You can use the –n flag to only output strings

longer than a certain length,

• Ex: strings file2 –n 6

Page 17: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

VirusTotal

• The “Google for Malware”

• Scans files with 60+ Anti-Virus (AV) providers

• Performs static and dynamic analysis

• Static: Looking at metadata, properties, NO EXECUTE

• Dynamic: Execute malware in sandbox and watch

Page 18: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

VirusTotal Examples

• Visit https://tinyurl.com/vtsample1 and or

https://tinyurl.com/vtsample2

https://tinyurl.com/vtsample1
https://tinyurl.com/vtsample2
Page 19: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Advanced Examination

Page 20: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

HxD / Hex Editor

• Enables you to view raw bytes of file

• Useful to check/edit magic bytes

• Can also be used to search for specific sequence of

bytes

Page 21: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor
Page 22: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

HxD Example

• Install HxD (or another hex editor)• https://mh-nexus.de/downloads/HxDSetup.zip

• Download problems.metactf.com/cns/file4.zip

• Extract file

• Open SampleBinary.exe in HxD

https://mh-nexus.de/downloads/HxDSetup.zip
Page 23: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

IDA

• Disassembler

• Displays raw assembly

code from executable

• Enables analyst to

trace through specific

sections of code

Page 24: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

IDA Example

• Install IDA Free

• hex-rays.com/products/ida/support/download_freeware.shtml

• Open SampleBinary.exe in IDA

https://www.hex-rays.com/products/ida/support/download_freeware.shtml
Page 25: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Detection

Page 26: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

YARA

• “The pattern matching swiss knife for malware

researchers”

• Create simple rules to match files on patterns,

strings instead of a single hash of the whole file

• Can still detect malware even if it changes

Page 27: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

YARA Demo

Page 28: Intro to Reverse Engineering and Malware Analysis · Malware Types (What) Ransomware •Encrypts all files and demands ransom •Example: WannaCry, (Not)Petya, TeslaCrypt RAT/Backdoor

Questions?


Related Documents
David Lagomasino1,2,* 1,2, Rene Price , Petya Campbell ... · David Lagomasino1,2,* 1,2, Rene Price , Petya Campbell3 & Dean Whitman1 1FIU: Department of Earth and Environment, Miami,

David Lagomasino1,2,* 1,2, Rene Price , Petya Campbell...

Category: Documents
Информационен Europe Direct наweb.uni-plovdiv.bg/petya/EIC_EuropeDirect_Plovdiv_Bulletin_10.pdf · Приоритетите на общата транспортна

Информационен Europe Direct...

Category: Documents
Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z....

Category: Documents
Petya Dubarowa

Petya Dubarowa

Category: Technology
Portfolio Petya M

Portfolio Petya M

Category: Documents
Beware of the Ninjas - imf-conference.org · APPLEWORM/LAZARUS • net user • ipconfig /all • net start • systeminfo • gpresult BILLBUG 08/05/18 11 Dual-Use Tools: Petya Petya

Beware of the Ninjas - imf-conference.org ·...

Category: Documents
Unit #8 - Temple MIS · 3. Encryption of disk drives (no decryption offered) Note: Petya is a family of encrypting ransomware that was first discovered in 2016. The malware targets

Unit #8 - Temple MIS · 3. Encryption of disk drives (no...

Category: Documents
Petya not petya

Petya not petya

Category: Technology
1 british airways, stakeholder analysis, petya laleva

1 british airways, stakeholder analysis, petya laleva

Category: Business
5 greenpeace vs nestle petya

5 greenpeace vs nestle petya

Category: Business
[PPT]Mitigating Rapid Cyberattacks (Petya, WannaCrypt, … · Web viewMitigating Rapid Cyberattacks(Petya, WannaCrypt, and similar) Mark Simos Lead Cybersecurity Architect, Microsoft

[PPT]Mitigating Rapid Cyberattacks (Petya, WannaCrypt,...

Category: Documents
Petya Rogić

Petya Rogić

Category: Documents