SlideShare a Scribd company logo
Malware, Cryptominer
& other Threat
Setia Juli Irzal Ismail
Malware Analyst
ID-CERT Telkom University
Introduction
Malware Analysis Technique
Cryptomining Malware
Other Threat
Discussion
Introduction
• Setia Juli Irzal Ismail
• Jul Ismail
• Malware Analyst – ID-CERT
• Lecturer – Telkom University
www.cert.or.id/
ID-CERT
• Indonesia Computer Emergency Response Team
• 1998 – Dr. Budi Rahardjo
• Community based
• Incident Handling
• Malware Lab
• Research & Training about Malware
• Tools: Malware Scanner
• Founder AP-CERT: JP-CERT & AusCERT
www.cert.or.id/
Malware
Wannacry
www.cert.or.id/
Wannacry
www.cert.or.id/
Eternal Blue exploit à
SMBv1
Double Pulsar Backdoor
Hospital
1 Million victim
Lazarus?
May 2017
March : Microsoft patch
Stuxnet
ATM - Malware
www.cert.or.id/
Malware
• Malicious Software
Classification
• Virus
l Worm
l Trojan
l Backdoor
l Adware
l Rootkit
l Ransomware
www.cert.or.id/
How does it Spread
• Email
• Flash Disk
• File Sharing
• Website
• Pirated Software
• Malicious apps
Why do people write malware
Back then
• Experiment
• Fun
• Alone
Now
• Money
• Spionage
• Steal Information
• Cyberweapon
• Cybercriminal group
• government
www.cert.or.id/
Malware Statistic
l 250.000 new sample/day – Sophos
l 800 million malware sample – AV Test
l 52% Indonesia – Kaspersky
l 17th
l 86% Pirated Software– ESET
l 97% Android malware
Malware Detection Technology
l Signature based
l Heuristik
www.cert.or.id/
Malware Analysis
Why Analyze Malware
To:
• assess damage
• discover indicator of compromise
• identify Vulnerability
• Catch the bad guy
• Answer questions
Indicator of compromise?
• Unusual Outbound Network
Traffic
• Anomalies in Privileged User
Account Activity
• Geographical Irregularities
• Increases in Database Read
Volume
• HTML Response Sizes
• Large Numbers of Requests
for the Same File
• Suspicious Registry or System
File Changes
• Unusual DNS Requests
• Unexpected Patching of
Systems
• Mobile Device Profile
Changes
• Unusual Web Traffic
• Signs of DDoS Activity
www.cert.or.id/
IoC
• Improve the IDS, Firewall, Antivirus
Basic Questions
• What is the purpose of malware?
• How did it get here?
• Who are they and how good are they?
• How to remove it?
• What did they get?
• How long has it been here?
• Does it spread to other machine?
• How do I prevent this from happening again?
www.cert.or.id/
Technical Questions
• Network Indicator?
• Host Based Indicator?
• Persistence Mechanism?
• Date of compilation & installation?
• What language was it written in?
• Is it Packed?
• Obfuscation technique?
• Rootkit Functionality?
Safe Environment
• Do not run Malware on your computer
• Dedicated Malware Lab
• Use Virtualization
• Vmware, Vbox etc
• Using different OS than your malware target (static Analysis)
www.cert.or.id/
Safe Environment??
• The malware behaviour might change
• Network, Conect to a C&C server?
• Facing real battle
• Our IP can become the target: consider using
• Accidentally attack other people
Fake Network
• Host Only networking feature on VM
• Fake DNS tool
• Listening ports and network activity
• Build custom C&C Server
www.cert.or.id/
Virtualization?
• Reduce risk
• Snapshot
• Video recording,
• Setup no network or host-only network
• sharing functionality?
• VM is not perfect
• Malware can detect VM
• Sometimes it can escape the sandbox (0 day worm)
Malware Analysis
• Static Analysis
• Dynamic Analysis
www.cert.or.id/
Static
• Code is not excuted
• Reverse engineering
• „Autopsy“ the code
Dynamic Analysis
• Running the code on Controlled environment
www.cert.or.id/
Static Analysis
• Safer
• But...
• Sometimes it is not easy
• Require good understanding programming
• Packer
• encrypt
• Insert junk code
• Anti analysis technique
Static Analysis
Steps
• Fingerprinting (hash)
• Scan with virus scanner; virustotal ; documentation
• PEiD: signature about compiler and packer
• Find Strings: strings, IDA Pro
• Web research; be carefull
www.cert.or.id/
Strings
• Message,
• URL address, IP
• email
• ASCII or Unicode format
Strings Example
• Malware Sample send a message (probably through email). file mail
system .dll
• Check email log, find suspect traffic, find mail system dll
• DLL: file yang berisi executable code yang sering dishare antara
berbagai aplikasi.
• DLL sendiri bukan malware. Namun sering dimanfaatkan oleh
malware
No Strings?
• Packer
• Obfuscation
www.cert.or.id/
Packed & obfuscated
• Technique to make life hard for a malware analyst
• Packed, source code program compressed à packer
• Obfuscated, hiding function of a program
• Packed & obfuscated will make the static analysis difficult à no string
• Functions LoadLibrary dan GetProcAddress
Packed & obfuscated- packing
Wrapper used to decompress running packed
Only wrapper could be read
www.cert.or.id/
Packed & obfuscated- Detection
PEiD
http:// upx.sourceforge.net/
upx -d PackedProgram.exe
Executables
• Windows : PE (Portable Executable)
• Linux: ELF (Executable and Linking Format)
• MacOS: Mach-O
www.cert.or.id/
PE
• Import
• Export
• Metadata
• Resources
PE Header
• Imports: Funtion from other library used bymalware
• Exports: function from malware that could be used by other program
• Time Date Stamp: compile time
• Sections : which section are there on the sample
• Subsystem: are the sample GUI or command line?
• Resources: String, icon, menu dll
www.cert.or.id/
Dynamic Analysis
Dynamic Analysis
• run the malware à observe its actions
Monitor the interaction with the
• file system
• Registry
• other processes
• network
www.cert.or.id/
Tools
• Process Monitor
• Process explorer
• Regshot
• Wireshark
• ApateDNS
• Netcat
• Monitor whole system
• filter out
Sandbox
• Automated malware analysis tool
• Special environment
• Cuckoo Sandbox
www.cert.or.id/
Malware cryptomining uploadv3
www.cert.or.id/
Cryptomining malware
Cryptocurrency
• Digital currency generated by computer
• Decentralized, no regulatory body; anonym
• Produced by solving complex mathematical algorithm à mining
• Miner process transaction –> recording blockchain; digital ledger
• Miner rewarded in the form of digital coin
www.cert.or.id/
Cryptomining Malware
• Use victim computer to run mining application
• Webste: use CPU power from visitor to mine coin
• Code run in the background
Bitcoin (BTC)
• 2009
• Market 700 Billion USD
• Mining 1 bitcoin: require 215 kilowatt hours of electricity for each
transaction
• 1390 new cryptocurrency
• Ethereum (ETH) , Monero (XMR), Litecoin (LTC), Ripple (XRP), Bitcoin
Cash (BCH)
www.cert.or.id/
Abuse
• 2017: 7000 website compromised à mining (Sucuri)
• Monero
• algorithm does not favor GPU’s
• can be mined by web browsers and normal computers
• privacy features that make transactions and wallets more difficult to
trace,
CoinHive
• cryptocurrency mining service: javascript
• small computer code designed to be installed on Web sites: API
• Web site owners to earn an income without running intrusive or
annoying advertisements
• some or all of the computing power of any browser that visits
• 32000 websites (publicwww.com)
www.cert.or.id/
Coinhive case
• Installed on hacked web sites
• December: embedded in Wifi Hotspot at Starbuck in Buenos Aires
• January: hidden inside Youtube advertisement
• February: Browsealoud (service for visually impaired)
• The Pirate Bay
• IOC: 100% CPU Load
• Conhive earn 30%
• Kasperksy report stop 70 million web miner (2017)
• All major CMS platform
• WordPress, Magento, Drupal and Joomla
www.cert.or.id/
Hiding tactic
• Encrypted
• Packed
• fake jQuery script name
• non-dotted decimal notation for the host name
• mimic Google Analytics parameters
• Public repo: GitHub
• distributing Javascript cryptominers
• placing the script in hidden iframes
Wannamine Case
• Mine Monero
• PowerShell and Windows Management Instrumentation
• EternalBlue exploit to spread
www.cert.or.id/
Digmine Case
• video file
• Facebook Messenger
• coded in AutoIt (a Windows scripting language)
• only runs on Facebook Messenger’s desktop/web browser
• send the fake video link out to all of their Facebook contacts
• downloading from C&C server
• installing an autostart mechanism in the registry
• launches Chrome loaded with a malicious extension
• CPU power to mining Monero.
Smominru & Adylkuzz
• Botnet
• Targeting Server
• EternalBlue Exploit (CVE-2017-0144)
• 24 Monero/day
• Oracle’s WebLogic Server (CVE-2017-10271)
www.cert.or.id/
Malware cryptomining uploadv3
Radiflow
Water
Treatment
Facility
www.cert.or.id/
Trickbot
• Existing malware family
• Add a coin miner module
• Spam attachment
• Steal credential from userà ewallet
RIG EK
• Exploit kits
• Distributing miner
Mobile and Mac
Android
• Fake apps
• Repackaging technique
• Alternative market; not on
Google Play
• com.coinhiveminer.CoinHive
Mac
• MacUpdate hack
• Modified OnyX, Firefox and
Deeper
• Embed shell script on the file
• Launch miner
www.cert.or.id/
Other Threat
Ransomware
• 2017 Ransomware year
• 400 varians
• Wannacry - May
• ExPetr - July
• BadRabbit - Oktober
www.cert.or.id
Wannacry
• Eternal Blue exploit à SMB
• Double Pulsar Backdoor
• Hospital
• 1 million victim
• Lazarus?
• Mei
• Maret : microsoft patch
ExPetr
• Ukraina, Russia
• 5000 victim
• Eternal Blue exploit
• DoublePulsar backdoor
• MeDoc – Update
• News Website in Ukraine
• 2 level encryption : victim file and MFT
• BlackEnergy’s KillDisk?
• July
www.cert.or.id
Ransomware as a service
• Malware kits : tools to make your own ransomware
• Darkweb
• Cerber, Satan, Philadelphia
• Ransomware Android, Mac, Linux
• Bitcoin à Monero
• Target: Health Industry, Government, Critical Infrastructure,
Education, Small & Medium Enterprises (SME)
Malware defense technique
• Anti security : AV, Firewall
• Anti sandbox : sandbox
• Anti analyst : packer, obfuscation, RE
• Machine learning evasion
• Hardware based evasion
www.cert.or.id
Timeline
• 1980: Encryption: cascade virus
• 1990: Polymorphic: Chameleon (encrypt,junk)
• 1998: Metamorphism (instruction diacak)
• 1999: Packer
• 1999: Rootkit:
• 2008: DGA: conficker worm
• 2011: Darknet Market: Silkroad
• 2015: Firmware : Equation Group, Hacking Team: IoT
• 2015: Dridex: obfuscation: powershell, sandbox evasion
• 2016: Fileless Malware
• 2017: Machine learning detection: Cerber
Darknet Market
• Cryptservice: $53 - FUD
• Lazercrypter: free packer
• Macro Exploit Crypt Service: Macro for spreading malware $53
• Crypter Source Code: $1,99
• Arctic Miner:cryptocurrency Miner: $3,2
• Betacrypt: Code mutation: $239
• BHGroup: crypter ASM & C: $35
• Tutorial FUD backdoor: $0,94
www.cert.or.id
Stegano Malware
• Steganography?
• 2011 Duqu: collecting information
• Enkrip data-> Embed File-> server CnC
• 2014: ZeusVM (Varian): image stegano, hide command
• 2016: Lurk: Encrypted Url->BMP file->download
payload
• 2016: Stegoloader
Sundown Exploit Kit-case
1. User browsing: compromised web or malware ads
2. Redirected to exploit server
3. Download picture (PNG) -> blank image
4. Encoded exploit à URL for download the payload
5. Exploit vulnerability on IE
www.cert.or.id
Stegano Malware - 2
• Cerber: Macro wordàdrop .vbs à download jpg
• Vawtrak: download favicon.ico
• Magento case: malware send the payment card information
with image stegano
• Network stegano: hiding the traffic to CnC server DNStraffic
or Http Request à teslacrypt
Android
• 2017: 10 million sampel malware android
• Rootnik
• Dloadr-ECZ
• Axent-ED
www.cert.or.id
King of Glory
• Game China
• Fake app – Ransomware
• Lock screen & Crypto ransom
• Lock Screen
• Judy: 36 million victim
• Xavir: 800 android apps
• WireX botnet: 140000 victim à Ddos
Ghostclicker
• 300 apps
• Disguise google play service library
• Facebook ads library
• adware
www.cert.or.id
Mac Malware
Mac Malware -2
• PUA
• Optimizer: MacKeeper, Advanced Mac Cleaner ,
TuneUpMyMac, dll
• MacRansom
• MacSpy.
www.cert.or.id
Microsoft - Malware
• Office
• Powershell
• Zero Day Vulnerability
Botnet
• Botnet?
• IoT : Ip camera
• Mirai Botnet à Tsunami Ddos
• IP Camera and router
• 620 Gbit/s : krebson security
• 1 Tbit/s OVH
www.cert.or.id
Other trend
• Distribusi Software: CC-Cleaner, ExPetr
• UEFI & BIOS attacks: hacking team
• Wiper: Shamoon à aramco
• Espionage malware & APT
• Social media: fake akun & bot à hoax
• Router & Modem hack
Beginner
• Practical malware analysis- Honig & Sikorski
• awesome malware analysis tools and resources
• Open Courseware by RPISEC
• Blog Lenny Zeltser
• The SANS Digital Forensics Blog
• Crackmes.de
www.cert.or.id
Terima Kasih
jul [at] tass.telkomuniversity.ac.id
jul_ismail
Blog: julismail.staff.telkomuniversity.ac.id
www.cert.or.id/

More Related Content

PDF
Aes jul-upload
PDF
Fruit vs Zombies: Defeat Non-jailbroken iOS Malware by Claud Xiao
PPTX
Weekend Malware Research 2012
PDF
ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...
PDF
Beginner’s Guide on How to Start Exploring IoT Security 1st Session
PPTX
Firmware analysis 101
PPTX
Path of Cyber Security
Aes jul-upload
Fruit vs Zombies: Defeat Non-jailbroken iOS Malware by Claud Xiao
Weekend Malware Research 2012
ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...
Beginner’s Guide on How to Start Exploring IoT Security 1st Session
Firmware analysis 101
Path of Cyber Security

What's hot (20)

PPTX
2014: Mid-Year Threat Review
PDF
Infosecurity.be 2019: What are relevant open source security tools you should...
PPTX
2016 TTL Security Gap Analysis with Kali Linux
PPTX
Ransomware - what is it, how to protect against it
PDF
Learn Ethical Hacking With Kali Linux | Ethical Hacking Tutorial | Kali Linux...
PPTX
Hacker bootcamp
PDF
Hack Attack! An Introduction to Penetration Testing
PDF
Top 10 Threats to Cloud Security
PDF
Csw2016 chaykin having_funwithsecuremessengers_and_androidwear
PPTX
Kali presentation
PDF
Socially Acceptable Methods to Walk in the Front Door
PPT
Anton Chuvakin on Honeypots
PDF
Kasza smashing the_jars
PPT
[ENG] IPv6 shipworm + My little Windows domain pwnie
PDF
TeelTech - Advancing Mobile Device Forensics (online version)
PPTX
Kali Linux - Falconer
PPT
Attacking Automatic Wireless Network Selection
PPTX
Kali Linux
PDF
HackInTheBox - AMS 2011 , Spying on SpyEye - What Lies Beneath ?
PDF
penetration test using Kali linux ppt
2014: Mid-Year Threat Review
Infosecurity.be 2019: What are relevant open source security tools you should...
2016 TTL Security Gap Analysis with Kali Linux
Ransomware - what is it, how to protect against it
Learn Ethical Hacking With Kali Linux | Ethical Hacking Tutorial | Kali Linux...
Hacker bootcamp
Hack Attack! An Introduction to Penetration Testing
Top 10 Threats to Cloud Security
Csw2016 chaykin having_funwithsecuremessengers_and_androidwear
Kali presentation
Socially Acceptable Methods to Walk in the Front Door
Anton Chuvakin on Honeypots
Kasza smashing the_jars
[ENG] IPv6 shipworm + My little Windows domain pwnie
TeelTech - Advancing Mobile Device Forensics (online version)
Kali Linux - Falconer
Attacking Automatic Wireless Network Selection
Kali Linux
HackInTheBox - AMS 2011 , Spying on SpyEye - What Lies Beneath ?
penetration test using Kali linux ppt
Ad

Similar to Malware cryptomining uploadv3 (20)

PPTX
Crypto Miners in the Cloud
PPTX
Botnets Attacks.pptx
PPTX
Malware analysis
PPTX
BSIDES-PR Keynote Hunting for Bad Guys
PPTX
Securing your Cloud Environment v2
PDF
Metasploitation part-1 (murtuja)
PPTX
Mobile platform security models
PDF
Workshop on Network Security
PDF
Internet security
PPT
Heartbleed Bug Vulnerability: Discovery, Impact and Solution
PPT
10-malware and online safety preacuations
PDF
Ransomware- What you need to know to Safeguard your Data
PPTX
I haz you and pwn your maal
PDF
Hacking your Android (slides)
PDF
Hacking your Droid (Aditya Gupta)
PPTX
Dealing with legacy code
PPTX
Hacktrikz - Introduction to Information Security & Ethical Hacking
PPTX
Web-App Remote Code Execution Via Scripting Engines
PDF
Smart Bombs: Mobile Vulnerability and Exploitation
Crypto Miners in the Cloud
Botnets Attacks.pptx
Malware analysis
BSIDES-PR Keynote Hunting for Bad Guys
Securing your Cloud Environment v2
Metasploitation part-1 (murtuja)
Mobile platform security models
Workshop on Network Security
Internet security
Heartbleed Bug Vulnerability: Discovery, Impact and Solution
10-malware and online safety preacuations
Ransomware- What you need to know to Safeguard your Data
I haz you and pwn your maal
Hacking your Android (slides)
Hacking your Droid (Aditya Gupta)
Dealing with legacy code
Hacktrikz - Introduction to Information Security & Ethical Hacking
Web-App Remote Code Execution Via Scripting Engines
Smart Bombs: Mobile Vulnerability and Exploitation
Ad

More from Setia Juli Irzal Ismail (20)

PDF
Petunjuk assessmen Kajian 3 - Attack defense
PDF
Minggu 2-2 Praktikum Instalasi RouterOS pada Virtualisasi-2.pdf
PDF
Introduction to self-Supervised learning - kuliah machine learning STEI ITB
PDF
Materi lanjutan Deep Learning S1 Telekomunikasi - STEI ITB
PDF
Slide materi pengantar kuliah Deep Learning STEI ITB
PDF
slide-share.pdf
PDF
slide-lp3i-final.pdf
PDF
society50-jul-share.pdf
PDF
57 slide presentation
PDF
Panduan Proyek Akhir D3 Teknologi Komputer Telkom University
PDF
Sosialisasi kurikulum2020
PDF
Welcoming maba 2020
PDF
Slide jul apcert agm 2016
PDF
Tugas besar MK Keamanan Jaringan
PDF
PDF
PDF
03 keamanan password
PDF
02 teknik penyerangan
PDF
01a pengenalan keamanan jaringan upload
PDF
Kajian3 upload
Petunjuk assessmen Kajian 3 - Attack defense
Minggu 2-2 Praktikum Instalasi RouterOS pada Virtualisasi-2.pdf
Introduction to self-Supervised learning - kuliah machine learning STEI ITB
Materi lanjutan Deep Learning S1 Telekomunikasi - STEI ITB
Slide materi pengantar kuliah Deep Learning STEI ITB
slide-share.pdf
slide-lp3i-final.pdf
society50-jul-share.pdf
57 slide presentation
Panduan Proyek Akhir D3 Teknologi Komputer Telkom University
Sosialisasi kurikulum2020
Welcoming maba 2020
Slide jul apcert agm 2016
Tugas besar MK Keamanan Jaringan
03 keamanan password
02 teknik penyerangan
01a pengenalan keamanan jaringan upload
Kajian3 upload

Recently uploaded (20)

PDF
3rd Neelam Sanjeevareddy Memorial Lecture.pdf
PDF
TR - Agricultural Crops Production NC III.pdf
PPTX
human mycosis Human fungal infections are called human mycosis..pptx
PPTX
Final Presentation General Medicine 03-08-2024.pptx
PPTX
PPH.pptx obstetrics and gynecology in nursing
PDF
Black Hat USA 2025 - Micro ICS Summit - ICS/OT Threat Landscape
PDF
Abdominal Access Techniques with Prof. Dr. R K Mishra
PDF
102 student loan defaulters named and shamed – Is someone you know on the list?
PPTX
GDM (1) (1).pptx small presentation for students
PPTX
IMMUNITY IMMUNITY refers to protection against infection, and the immune syst...
PDF
Computing-Curriculum for Schools in Ghana
PDF
grade 11-chemistry_fetena_net_5883.pdf teacher guide for all student
PPTX
Introduction_to_Human_Anatomy_and_Physiology_for_B.Pharm.pptx
PDF
VCE English Exam - Section C Student Revision Booklet
PDF
FourierSeries-QuestionsWithAnswers(Part-A).pdf
PDF
Module 4: Burden of Disease Tutorial Slides S2 2025
PPTX
Cell Types and Its function , kingdom of life
PDF
Insiders guide to clinical Medicine.pdf
PPTX
1st Inaugural Professorial Lecture held on 19th February 2020 (Governance and...
PPTX
PPT- ENG7_QUARTER1_LESSON1_WEEK1. IMAGERY -DESCRIPTIONS pptx.pptx
3rd Neelam Sanjeevareddy Memorial Lecture.pdf
TR - Agricultural Crops Production NC III.pdf
human mycosis Human fungal infections are called human mycosis..pptx
Final Presentation General Medicine 03-08-2024.pptx
PPH.pptx obstetrics and gynecology in nursing
Black Hat USA 2025 - Micro ICS Summit - ICS/OT Threat Landscape
Abdominal Access Techniques with Prof. Dr. R K Mishra
102 student loan defaulters named and shamed – Is someone you know on the list?
GDM (1) (1).pptx small presentation for students
IMMUNITY IMMUNITY refers to protection against infection, and the immune syst...
Computing-Curriculum for Schools in Ghana
grade 11-chemistry_fetena_net_5883.pdf teacher guide for all student
Introduction_to_Human_Anatomy_and_Physiology_for_B.Pharm.pptx
VCE English Exam - Section C Student Revision Booklet
FourierSeries-QuestionsWithAnswers(Part-A).pdf
Module 4: Burden of Disease Tutorial Slides S2 2025
Cell Types and Its function , kingdom of life
Insiders guide to clinical Medicine.pdf
1st Inaugural Professorial Lecture held on 19th February 2020 (Governance and...
PPT- ENG7_QUARTER1_LESSON1_WEEK1. IMAGERY -DESCRIPTIONS pptx.pptx

Malware cryptomining uploadv3

  • 1. Malware, Cryptominer & other Threat Setia Juli Irzal Ismail Malware Analyst ID-CERT Telkom University
  • 3. Introduction • Setia Juli Irzal Ismail • Jul Ismail • Malware Analyst – ID-CERT • Lecturer – Telkom University www.cert.or.id/
  • 4. ID-CERT • Indonesia Computer Emergency Response Team • 1998 – Dr. Budi Rahardjo • Community based • Incident Handling • Malware Lab • Research & Training about Malware • Tools: Malware Scanner • Founder AP-CERT: JP-CERT & AusCERT www.cert.or.id/
  • 7. Wannacry www.cert.or.id/ Eternal Blue exploit à SMBv1 Double Pulsar Backdoor Hospital 1 Million victim Lazarus? May 2017 March : Microsoft patch
  • 11. Classification • Virus l Worm l Trojan l Backdoor l Adware l Rootkit l Ransomware www.cert.or.id/
  • 12. How does it Spread • Email • Flash Disk • File Sharing • Website • Pirated Software • Malicious apps
  • 13. Why do people write malware Back then • Experiment • Fun • Alone Now • Money • Spionage • Steal Information • Cyberweapon • Cybercriminal group • government www.cert.or.id/
  • 14. Malware Statistic l 250.000 new sample/day – Sophos l 800 million malware sample – AV Test l 52% Indonesia – Kaspersky l 17th l 86% Pirated Software– ESET l 97% Android malware
  • 15. Malware Detection Technology l Signature based l Heuristik www.cert.or.id/
  • 17. Why Analyze Malware To: • assess damage • discover indicator of compromise • identify Vulnerability • Catch the bad guy • Answer questions
  • 18. Indicator of compromise? • Unusual Outbound Network Traffic • Anomalies in Privileged User Account Activity • Geographical Irregularities • Increases in Database Read Volume • HTML Response Sizes • Large Numbers of Requests for the Same File • Suspicious Registry or System File Changes • Unusual DNS Requests • Unexpected Patching of Systems • Mobile Device Profile Changes • Unusual Web Traffic • Signs of DDoS Activity www.cert.or.id/
  • 19. IoC • Improve the IDS, Firewall, Antivirus
  • 20. Basic Questions • What is the purpose of malware? • How did it get here? • Who are they and how good are they? • How to remove it? • What did they get? • How long has it been here? • Does it spread to other machine? • How do I prevent this from happening again? www.cert.or.id/
  • 21. Technical Questions • Network Indicator? • Host Based Indicator? • Persistence Mechanism? • Date of compilation & installation? • What language was it written in? • Is it Packed? • Obfuscation technique? • Rootkit Functionality?
  • 22. Safe Environment • Do not run Malware on your computer • Dedicated Malware Lab • Use Virtualization • Vmware, Vbox etc • Using different OS than your malware target (static Analysis) www.cert.or.id/
  • 23. Safe Environment?? • The malware behaviour might change • Network, Conect to a C&C server? • Facing real battle • Our IP can become the target: consider using • Accidentally attack other people
  • 24. Fake Network • Host Only networking feature on VM • Fake DNS tool • Listening ports and network activity • Build custom C&C Server www.cert.or.id/
  • 25. Virtualization? • Reduce risk • Snapshot • Video recording, • Setup no network or host-only network • sharing functionality? • VM is not perfect • Malware can detect VM • Sometimes it can escape the sandbox (0 day worm)
  • 26. Malware Analysis • Static Analysis • Dynamic Analysis www.cert.or.id/
  • 27. Static • Code is not excuted • Reverse engineering • „Autopsy“ the code
  • 28. Dynamic Analysis • Running the code on Controlled environment www.cert.or.id/
  • 29. Static Analysis • Safer • But... • Sometimes it is not easy • Require good understanding programming • Packer • encrypt • Insert junk code • Anti analysis technique
  • 31. Steps • Fingerprinting (hash) • Scan with virus scanner; virustotal ; documentation • PEiD: signature about compiler and packer • Find Strings: strings, IDA Pro • Web research; be carefull www.cert.or.id/
  • 32. Strings • Message, • URL address, IP • email • ASCII or Unicode format
  • 33. Strings Example • Malware Sample send a message (probably through email). file mail system .dll • Check email log, find suspect traffic, find mail system dll • DLL: file yang berisi executable code yang sering dishare antara berbagai aplikasi. • DLL sendiri bukan malware. Namun sering dimanfaatkan oleh malware
  • 34. No Strings? • Packer • Obfuscation www.cert.or.id/
  • 35. Packed & obfuscated • Technique to make life hard for a malware analyst • Packed, source code program compressed à packer • Obfuscated, hiding function of a program • Packed & obfuscated will make the static analysis difficult à no string • Functions LoadLibrary dan GetProcAddress
  • 36. Packed & obfuscated- packing Wrapper used to decompress running packed Only wrapper could be read www.cert.or.id/
  • 37. Packed & obfuscated- Detection PEiD http:// upx.sourceforge.net/ upx -d PackedProgram.exe
  • 38. Executables • Windows : PE (Portable Executable) • Linux: ELF (Executable and Linking Format) • MacOS: Mach-O www.cert.or.id/
  • 39. PE • Import • Export • Metadata • Resources
  • 40. PE Header • Imports: Funtion from other library used bymalware • Exports: function from malware that could be used by other program • Time Date Stamp: compile time • Sections : which section are there on the sample • Subsystem: are the sample GUI or command line? • Resources: String, icon, menu dll www.cert.or.id/
  • 42. Dynamic Analysis • run the malware à observe its actions Monitor the interaction with the • file system • Registry • other processes • network www.cert.or.id/
  • 43. Tools • Process Monitor • Process explorer • Regshot • Wireshark • ApateDNS • Netcat • Monitor whole system • filter out
  • 44. Sandbox • Automated malware analysis tool • Special environment • Cuckoo Sandbox www.cert.or.id/
  • 48. Cryptocurrency • Digital currency generated by computer • Decentralized, no regulatory body; anonym • Produced by solving complex mathematical algorithm à mining • Miner process transaction –> recording blockchain; digital ledger • Miner rewarded in the form of digital coin www.cert.or.id/
  • 49. Cryptomining Malware • Use victim computer to run mining application • Webste: use CPU power from visitor to mine coin • Code run in the background
  • 50. Bitcoin (BTC) • 2009 • Market 700 Billion USD • Mining 1 bitcoin: require 215 kilowatt hours of electricity for each transaction • 1390 new cryptocurrency • Ethereum (ETH) , Monero (XMR), Litecoin (LTC), Ripple (XRP), Bitcoin Cash (BCH) www.cert.or.id/
  • 51. Abuse • 2017: 7000 website compromised à mining (Sucuri) • Monero • algorithm does not favor GPU’s • can be mined by web browsers and normal computers • privacy features that make transactions and wallets more difficult to trace,
  • 52. CoinHive • cryptocurrency mining service: javascript • small computer code designed to be installed on Web sites: API • Web site owners to earn an income without running intrusive or annoying advertisements • some or all of the computing power of any browser that visits • 32000 websites (publicwww.com) www.cert.or.id/
  • 53. Coinhive case • Installed on hacked web sites • December: embedded in Wifi Hotspot at Starbuck in Buenos Aires • January: hidden inside Youtube advertisement • February: Browsealoud (service for visually impaired) • The Pirate Bay • IOC: 100% CPU Load • Conhive earn 30% • Kasperksy report stop 70 million web miner (2017)
  • 54. • All major CMS platform • WordPress, Magento, Drupal and Joomla www.cert.or.id/
  • 55. Hiding tactic • Encrypted • Packed • fake jQuery script name • non-dotted decimal notation for the host name • mimic Google Analytics parameters • Public repo: GitHub • distributing Javascript cryptominers • placing the script in hidden iframes
  • 56. Wannamine Case • Mine Monero • PowerShell and Windows Management Instrumentation • EternalBlue exploit to spread www.cert.or.id/
  • 57. Digmine Case • video file • Facebook Messenger • coded in AutoIt (a Windows scripting language) • only runs on Facebook Messenger’s desktop/web browser • send the fake video link out to all of their Facebook contacts • downloading from C&C server • installing an autostart mechanism in the registry • launches Chrome loaded with a malicious extension • CPU power to mining Monero.
  • 58. Smominru & Adylkuzz • Botnet • Targeting Server • EternalBlue Exploit (CVE-2017-0144) • 24 Monero/day • Oracle’s WebLogic Server (CVE-2017-10271) www.cert.or.id/
  • 61. Trickbot • Existing malware family • Add a coin miner module • Spam attachment • Steal credential from userà ewallet RIG EK • Exploit kits • Distributing miner
  • 62. Mobile and Mac Android • Fake apps • Repackaging technique • Alternative market; not on Google Play • com.coinhiveminer.CoinHive Mac • MacUpdate hack • Modified OnyX, Firefox and Deeper • Embed shell script on the file • Launch miner www.cert.or.id/
  • 64. Ransomware • 2017 Ransomware year • 400 varians • Wannacry - May • ExPetr - July • BadRabbit - Oktober www.cert.or.id
  • 65. Wannacry • Eternal Blue exploit à SMB • Double Pulsar Backdoor • Hospital • 1 million victim • Lazarus? • Mei • Maret : microsoft patch
  • 66. ExPetr • Ukraina, Russia • 5000 victim • Eternal Blue exploit • DoublePulsar backdoor • MeDoc – Update • News Website in Ukraine • 2 level encryption : victim file and MFT • BlackEnergy’s KillDisk? • July www.cert.or.id
  • 67. Ransomware as a service • Malware kits : tools to make your own ransomware • Darkweb • Cerber, Satan, Philadelphia • Ransomware Android, Mac, Linux • Bitcoin à Monero • Target: Health Industry, Government, Critical Infrastructure, Education, Small & Medium Enterprises (SME)
  • 68. Malware defense technique • Anti security : AV, Firewall • Anti sandbox : sandbox • Anti analyst : packer, obfuscation, RE • Machine learning evasion • Hardware based evasion www.cert.or.id
  • 69. Timeline • 1980: Encryption: cascade virus • 1990: Polymorphic: Chameleon (encrypt,junk) • 1998: Metamorphism (instruction diacak) • 1999: Packer • 1999: Rootkit: • 2008: DGA: conficker worm • 2011: Darknet Market: Silkroad • 2015: Firmware : Equation Group, Hacking Team: IoT • 2015: Dridex: obfuscation: powershell, sandbox evasion • 2016: Fileless Malware • 2017: Machine learning detection: Cerber
  • 70. Darknet Market • Cryptservice: $53 - FUD • Lazercrypter: free packer • Macro Exploit Crypt Service: Macro for spreading malware $53 • Crypter Source Code: $1,99 • Arctic Miner:cryptocurrency Miner: $3,2 • Betacrypt: Code mutation: $239 • BHGroup: crypter ASM & C: $35 • Tutorial FUD backdoor: $0,94 www.cert.or.id
  • 71. Stegano Malware • Steganography? • 2011 Duqu: collecting information • Enkrip data-> Embed File-> server CnC • 2014: ZeusVM (Varian): image stegano, hide command • 2016: Lurk: Encrypted Url->BMP file->download payload • 2016: Stegoloader
  • 72. Sundown Exploit Kit-case 1. User browsing: compromised web or malware ads 2. Redirected to exploit server 3. Download picture (PNG) -> blank image 4. Encoded exploit à URL for download the payload 5. Exploit vulnerability on IE www.cert.or.id
  • 73. Stegano Malware - 2 • Cerber: Macro wordàdrop .vbs à download jpg • Vawtrak: download favicon.ico • Magento case: malware send the payment card information with image stegano • Network stegano: hiding the traffic to CnC server DNStraffic or Http Request à teslacrypt
  • 74. Android • 2017: 10 million sampel malware android • Rootnik • Dloadr-ECZ • Axent-ED www.cert.or.id
  • 75. King of Glory • Game China • Fake app – Ransomware • Lock screen & Crypto ransom • Lock Screen • Judy: 36 million victim • Xavir: 800 android apps • WireX botnet: 140000 victim à Ddos
  • 76. Ghostclicker • 300 apps • Disguise google play service library • Facebook ads library • adware www.cert.or.id
  • 78. Mac Malware -2 • PUA • Optimizer: MacKeeper, Advanced Mac Cleaner , TuneUpMyMac, dll • MacRansom • MacSpy. www.cert.or.id
  • 79. Microsoft - Malware • Office • Powershell • Zero Day Vulnerability
  • 80. Botnet • Botnet? • IoT : Ip camera • Mirai Botnet à Tsunami Ddos • IP Camera and router • 620 Gbit/s : krebson security • 1 Tbit/s OVH www.cert.or.id
  • 81. Other trend • Distribusi Software: CC-Cleaner, ExPetr • UEFI & BIOS attacks: hacking team • Wiper: Shamoon à aramco • Espionage malware & APT • Social media: fake akun & bot à hoax • Router & Modem hack
  • 82. Beginner • Practical malware analysis- Honig & Sikorski • awesome malware analysis tools and resources • Open Courseware by RPISEC • Blog Lenny Zeltser • The SANS Digital Forensics Blog • Crackmes.de www.cert.or.id
  • 83. Terima Kasih jul [at] tass.telkomuniversity.ac.id jul_ismail Blog: julismail.staff.telkomuniversity.ac.id www.cert.or.id/