However, there has never been known released builders for this RAT, except the one from Ahnlab which allows the building of very old samples (2011), and another which was discussed in our previous post.
By Fabien Perigaud on 2016/06/22, 10:27 - Reverse engineering
By Andrew Dove on 2016/03/23, 14:53 - Reverse engineering
During a recent talk by a representative of MalwareBytes, it was discussed that several modern malware families, notable Poweliks, Phase Bot and Kovter are moving away from the file system and are instead establishing persistence in the registry of the host. This blog outlines the infection vector used by the kovter malware and the analysis method used to investigate it.
By Andrew Dove on 2016/03/04, 13:37 - Tool
Recently I have been encountering more and more devices encrypted with Microsoft's Bitlocker. As I tend to perform a lot of my forensics work on a Linux host I needed to find a way to work with these volumes. Thankfully it turns out that an opensource driver has been written for this purpose. This post contains a brief outline of now to install and use this driver.
By Fabien Perigaud on 2015/12/15, 13:30 - Reverse engineering
Derusbi is a well-known RAT family, used in various APT attacks since at least 2008. Many papers (1,2,3) have described two known variants of this malware: a client version, acting as any other RAT by contacting its C&C server, as well as a server version, which just listens for incoming connections from a client.
This RAT seems to be continuously evolving, as enlightened by Sekoia which recently described a new way for Derusbi to bypass Windows drivers signature enforcement.
In this blog post, we'll present the analysis of two new variants we encountered: a driver for x64 Windows, and a Linux library.
By Yoann Francou on 2015/12/07, 10:52 - Reverse engineering
This post is the second part of article on the Sakula malware. It follows the first one available here and covers versions 2.x and 3.x.
By Yoann Francou on 2015/11/09, 10:28 - Reverse engineering
This post follows a paper published by Symantec about a group of attackers known as BlackVine. It describes the technical evolution of the custom-developed RAT Sakula used in campaigns targeting industries such as energy, aerospace and healthcare.
By Fabien Perigaud on 2015/09/08, 17:02 - Reverse engineering
Just after releasing our previous blog post, we encountered a new PlugX variant using a bigger configuration than usual. We thus decided to study it and update our volatility plugin to handle the latest PlugX versions.
By Fabien Perigaud on 2015/08/06, 09:54 - Reverse engineering
It has been a while since we last wrote about PlugX RAT.
JPCERT made a great blog post covering the latest features added to the RAT, such as:
- New protocol (raw IP protocol 0xff)
- P2P communications
- MAC address binding
- Process injection for UAC bypass
- New encoding algorithm
This post aims at giving new elements we discovered during our investigations on this infamous malware.
By Fabien Perigaud, Boris Batteux on 2014/12/15, 15:06 - Reverse engineering
VinSelf is a known RAT malware already explained on other blogs . It's a family that has been long used in APT attacks. VinSelf can be recognized in two ways:
- the network patterns used;
- the strings obfuscation in the binary.
By Cedric Pernet on 2014/12/02, 15:53 - DFIR
Being successful at compromising one or several workstations and/or servers from a targeted company is an important step for APT attackers. Just after the initial compromise step, there are 2 possible situations:
- The attacker managed to gain high privileges on the system.
- The attacker only managed to compromise machines with regular user privileges.
More often than one would think of, normal user rights can be enough for an APT attacker. This is the case when the attacker has aimed for a particular machine/user which he knows to store the information he wants, or an access to it. The most common situation here is when the attacker has been pushing his reconnaissance phase far enough to know exactly which user is working on a project he wants to steal. He can either aim for the users e-mail box, or decide to go for a compromise of the user's computer.
However, it is more common for APT attackers to want to get a lot more information. Therefore, they aim at compromising the whole information system, and the best way to do that is to elevate their privileges and go for an Active Directory complete dump.
So how does the attacker do, not to be stuck in one workstation with usual user rights ? Well, he does just the same as a penetration tester would do at this step, and this is what this blog post is about.
By Jonathan-Christofer Demay on 2014/11/18, 09:00 - Tool
The large adoption of wireless devices goes further than WiFi networks: smartmeters, wearable devices, etc. The engineers behind these new types of devices may not have a deep security background and it can lead to security and privacy issues when a particular technology is stressed. However, to assess the security of these devices, the only current solution would be a dedicated hardware component with an appropriate radio interface for each available technology. Such components are not easy to engineer and this is why we developed Scapy-radio, a generic wireless monitor/injector tool based on Software Defined Radio using GNU Radio and the well-known Scapy framework. In this paper, we present this tool we developed for a wide range of wireless security assessments. The main goal of our tool is to provide effective penetration testing capabilities to security auditors with little to no knowledge of radio communication systems.
By Jérémy Richard on 2014/10/24, 13:18 - Reverse engineering
The PWC-named malware OrcaRat is presented as a new piece of malware but looking at the URI used for C&C communication, it could be an updated version of a well-known and kind of old piece of malware: LeoUncia.
By David Bizeul, Ivan Fontarensky, Ronan Mouchoux, Fabien Perigaud, Cedric Pernet on 2014/07/11, 11:00 - Investigation
Cyber espionage has been a hot topic through the last years. Computer attacks known as “APT” (Advanced Persistent Threat) have become widely reported and emphasized by the media, damages are now considered as real and strategic trends are moving in cyber defense.
Today, we decided to release publicly information on a specific group of APT attackers known as “Pitty Tiger”. This information comes directly from investigations led by our Threat Intelligence and enlights the activities of a structured organization working in the APT field.
You can get more information in our Whitepaper.
By Cedric Pernet on 2014/06/20, 09:45 - DFIR
This blog post is part of a series on APT killchain. In the previous step, we've seen how the attacker used reconnaissance techniques to collect data on its target. Now we will focus on the initial compromise.
At this stage, the APT attackers have a solid knowledge of their target and its key employees. The attackers have everything they need to start looking for an entry point to the company’s network and establish one or several permanent backdoor accesses.
By Fabien Perigaud on 2014/06/03, 15:52 - Reverse engineering
This time, it seems Google has fixed an old vulnerability, allowing to elevate privileges from an application with a few permissions to root, on any Android version supporting Android Secure External Caches (ASEC).
By Cedric Pernet on 2014/05/23, 11:46 - DFIR
This blog post is part of a series on APT killchain. On this blog post we focus on the reconnaissance step. All the information written here comes directly from our observations and experience on APT incident handling and APT pentest simulations.
Time for action has started. The attackers have chosen one target, now they have to start working on it.
It does not mean they will rush into the attack as soon as they have a target name. There is no interest in blindly attacking a company’s servers. Like in a lot of other subjects, a good attack is an attack which has been prepared carefully.
The longer the attackers spend time in knowing their target and its online presence, the easiest it will be to find efficient ways to penetrate that company’s systems. This is a bit like penetration testing. If you have ever been involved in such an activity, you know that there are different kinds of pentests, mostly depending on the perimeter to evaluate. Some pentests will cover a narrow part of a company’s network infrastructure (web server for example) while some others will cover a wider area. In the widest case (probably the most interesting one if you have enough time), such a pentest will consist of getting only a company’s name and digging for any vulnerability one can find. The pentester has to find several ways to attack the system, and penetrate it successfully before showing his results to the system’s owner.
After all, technically speaking, in which aspect is the beginning of an APT attack different to a penetration test?
The penetration tester will try to find as many vulnerabilities as he can, to report it to the customer. The APT attacker will try to find one or several vulnerabilities to penetrate the system. The APT attacker won’t search for all the vulnerabilities: one or two are enough for him.
The first phase of an APT is similar to the first phase of a penetration testing service; it is the reconnaissance phase, which can also be called “information gathering” phase.
By Cedric Pernet on 2014/05/07, 17:00 - DFIR
Last week we defined what an APT is. As we have seen, there are different definitions, and I bet nearly all companies working on APT incident handling do have their own definition.
What every experienced APT incident responder agrees on, is the way APT attacks are conducted.
The APT kill chain can be presented with some variations, depending on the detail level you want to show, yet its content is always the same. We chose to show here the easiest kill chain we could draw, not to panic anyone with technical details (yet). We will really go deep into every process of an APT attack in this serie of blog posts, yet we believe it is good to start explaining it from a distant point of view.
By Cedric Pernet on 2014/04/28, 10:33 - DFIR
Today we decided to release a serie of blog posts regarding the APT kill chain, in an effort to share our experience and knowledge on this hot topic.
For starters, “APT” stands for Advanced Persistent Threat.
Some people do not use this word at all, considering that this acronym is just a buzzword, created by some creative marketing wizard –or even a team of wizards- to describe a computer attack aimed at companies. These three words do strike the spirit of anyone who is inexperienced in computer security and immediately raise fear, not to mention terror. A sure thing is that it does not leave anyone indifferent. People do imagine a lot of different things behind these words, depending on their knowledge and experience. It basically goes from “well, another attack” to “attackers are everywhere in the system, they’re inside all the computers, ALARM ! ALARM ! HELP !”
Yet, there have been different definitions for APT, which we will now explore briefly.
By Julien Francq on 2014/04/18, 13:37 - Hardware
Hardware Trojans are considered to be an emerging threat for critical infrastructures. We are going to develop Hardware Trojans detection method in the European funded HINT project, that is described below.
By Cedric Pernet on 2014/04/10, 14:48 - Investigation
Some weeks ago, we have been blogging about a new ransomware called BitCrypt.
To sum it up shorty, we had found a new ransomware which encrypted all pictures on the machine it infected, and asked the user to pay a ransom to get the files back.
While we do not usually work on that kind of malware, preferring to dive into APT malware, we spent several hours on this one because of an indirect impact on a friend.
So we started reverse engineering the binary, and found a flaw in its encryption implementation, which we managed to break and get the encrypted files back.
During the following week, the decryption tool we released publicly helped some victims to successfully decrypt their images. That was before the BitCrypt author released a new version of his ransomware: Bitcrypt 2. We were curious enough to have a look on it.
« previous entries - page 1 of 2