[00:00.000 --> 00:00.340]  Went away.
[00:00.480 --> 00:00.700]  Awesome.
[00:00.920 --> 00:01.240]  All right.
[00:01.440 --> 00:02.960]  So, hello.
[00:03.420 --> 00:06.740]  This is a talk about open source malware labs.
[00:07.380 --> 00:14.460]  And this is going to be not necessarily reverse engineering, but basically malware analysis and then automation thereof.
[00:14.820 --> 00:16.700]  So, who am I?
[00:16.800 --> 00:19.420]  I'm the director of research innovation at ThreatConnect.
[00:19.780 --> 00:21.260]  I'm on the research team.
[00:22.060 --> 00:32.560]  And the basic, you know, premise of my talk is malware analysis labs, but I need to answer the question, why do I need a malware analysis lab?
[00:32.720 --> 00:36.180]  So, there are a number of reasons why you would need a malware analysis lab.
[00:36.320 --> 00:49.600]  So, if you're doing malware analysis as from a research perspective, you need to have an automated malware analysis system to work on your samples because there's a problem of scaling in the world that we live in.
[00:49.680 --> 00:54.200]  There's more people producing malware than there are people, you know, analyzing malware.
[00:54.440 --> 01:02.420]  So, you need to have something that automates many of the grunt work components of of automated malware analysis, or malware analysis.
[01:02.820 --> 01:11.060]  So what you see on the right side, this is from Lenny Zeltzer's stages of malware analysis.
[01:11.360 --> 01:16.520]  And so at the bottom, you can see there is a fully automated analysis.
[01:16.780 --> 01:21.080]  And then you have static properties analysis, and then interactive behavior analysis.
[01:21.100 --> 01:28.240]  So this is actually either instrumenting a binary or using a debugger and stepping through the code.
[01:28.240 --> 01:36.520]  And then at the top in difficulty level, so we're actually rising in difficulty level here, you have manual code reversing.
[01:36.920 --> 01:45.700]  So this is using IDA Pro, or Hopper, or something like that, and looking at the assembly code and understanding what the capabilities of the malware are.
[01:45.980 --> 01:52.200]  So what we're going to talk about today is actually not the two top harder stages.
[01:52.200 --> 01:57.420]  We're going to talk about the bottom two, and these are ones that you can completely automate.
[01:58.740 --> 02:13.660]  So one of the things, by the way, is that the, you know, automated malware analysis systems traditionally, you know, people think of them as behavioral and not static, but actually you can do static analysis as well.
[02:13.760 --> 02:15.780]  You get that kind of for free, and we'll see that in a moment.
[02:16.200 --> 02:20.740]  So what can you do with automated malware analysis system?
[02:21.020 --> 02:24.160]  So you can use it to enhance a threat intelligence program.
[02:24.160 --> 02:33.500]  If you have, you know, if your organization has, like, threat and tell people, like, they're going to be consumers of the data that comes out of an automated malware analysis system.
[02:34.180 --> 02:53.320]  There's also the concept, it's a fairly new concept of a hunt team, where you have things that go bad or things that alert in your organization, and then your, you know, incident response or incident responders will go and look at what happened.
[02:53.320 --> 02:55.760]  So a hunt team is actually proactive.
[02:56.060 --> 03:02.780]  So what they do is kind of the same thing that an IR team will do, but they're not responding to an incident.
[03:02.900 --> 03:10.240]  They're actually digging into different things in your organization and looking for malware and looking for adversaries.
[03:10.240 --> 03:22.340]  So any team like that, if they find a piece of malware that hasn't been alerted, they need to have some system that they can do the, you know, the easy stuff for them.
[03:22.920 --> 03:24.300]  Also, network defense.
[03:24.700 --> 03:41.140]  So if you have a network defense system, and, you know, there's many different flavors thereof, but when you have something that does network intrusion detection, many NID systems will have a way to carve files out of the network traffic.
[03:41.360 --> 03:46.320]  And so you need to have something that will look automatically at those different files.
[03:46.440 --> 03:48.980]  So that's one position that an AMA will have.
[03:50.160 --> 03:54.420]  Also, if you have an email server, you have a lot of attachments.
[03:54.420 --> 04:00.140]  And so the attachments that come into your organization need to be analyzed using an AMA.
[04:00.400 --> 04:03.660]  And then finally, host-based intrusion detection systems.
[04:03.800 --> 04:07.700]  And so, you know, this is the kind of medical term, but endpoint protection.
[04:07.960 --> 04:13.660]  So many endpoint protection systems will report a binary back to their mothership.
[04:13.800 --> 04:18.600]  And so that binary needs to be analyzed if it's not detected by that HID system.
[04:19.180 --> 04:25.800]  And then finally, this is the thing that I use everything for, because I love malware analysis, and it's a lot of fun.
[04:27.640 --> 04:34.360]  So my talk today is about malware analysis as a process, but entry points.
[04:34.400 --> 04:38.840]  So you have a number of different things that you can analyze.
[04:38.840 --> 04:44.320]  And so I've picked the top four, I think, of entry points into the system.
[04:44.320 --> 04:48.100]  And file is the obvious one.
[04:48.240 --> 04:49.300]  So these are executables.
[04:49.660 --> 04:55.260]  It also encompasses Java JAR files, anything that is executable on a system.
[04:55.560 --> 04:58.100]  It also encompasses documents.
[04:58.100 --> 05:03.380]  So you have rich text files, you know, Word docs, Excel.
[05:03.760 --> 05:05.080]  You also have PDF.
[05:05.500 --> 05:10.060]  And then the next entry point I'm talking about is URLs.
[05:10.060 --> 05:11.820]  So you have drive-by URLs.
[05:12.040 --> 05:14.920]  You also have download URLs for malware payloads.
[05:15.000 --> 05:18.800]  And so these need to be analyzed in a different way than a file.
[05:19.040 --> 05:20.480]  You also have PCAP.
[05:20.600 --> 05:22.440]  And so we'll talk about what PCAP is.
[05:22.600 --> 05:24.000]  But basically this is network traffic.
[05:24.040 --> 05:31.880]  So you may have a small amount of network traffic that you want to analyze and analyze for malware analysis.
[05:32.700 --> 05:34.560]  And then a memory image.
[05:34.560 --> 05:42.820]  So when you run malware, a really good way to find out what it's doing and what it's thinking is basically looking at the memory image while it's running.
[05:43.700 --> 05:50.200]  So each one of these particular entry points in the malware analysis process has an open-source tool that you can use.
[05:50.740 --> 05:56.120]  And by the way, I don't want to start any fights as far as, like, which tool is better than another.
[05:56.280 --> 05:58.220]  I just chose the ones that I use.
[05:58.220 --> 06:03.180]  And so when you're analyzing a file, I use Cuckoo Sandbox.
[06:03.420 --> 06:05.320]  And there are, you know, paid solutions.
[06:05.320 --> 06:16.160]  But the thing is, for this talk, I'm only going to talk about things that are either, A, open-source, or B, something that you can log into for free.
[06:16.360 --> 06:21.620]  And so, you know, there's some systems that I'm going to talk about you may need to actually register for, but they are free.
[06:22.680 --> 06:24.040]  And then Thug.
[06:24.460 --> 06:28.740]  This is probably the least famous of all of these tools.
[06:29.000 --> 06:35.620]  But Thug is a low-interaction honey client that looks at URLs and analyzes a URL.
[06:36.600 --> 06:39.780]  Bro is a network security monitoring tool.
[06:40.180 --> 06:52.020]  And there's a nuance in what I'm talking about today because Bro can be used as a traditional network security monitoring tool to look at, you know, broad network capture.
[06:52.220 --> 06:56.220]  I'm going to talk about it as a malware analysis tool.
[06:56.620 --> 06:59.340]  We'll get into the details of that in a moment.
[06:59.660 --> 07:00.780]  And then Volatility.
[07:00.980 --> 07:03.640]  Volatility is a memory analysis tool.
[07:04.020 --> 07:07.140]  So, first, let's look at Cuckoo Sandbox.
[07:07.440 --> 07:13.240]  And actually, earlier today, I included a lot of very new information in my talk.
[07:13.240 --> 07:19.180]  So, we're going to look at some malware that is very fresh within the past two weeks.
[07:19.720 --> 07:24.700]  So, the Cuckoo Sandbox part of this talk is... has some of the older stuff.
[07:24.920 --> 07:30.880]  And so, I'm going to kind of, you know, move quickly over this to get into the really... the new stuff in my talk.
[07:31.080 --> 07:41.100]  So, a sandbox, if you don't know what it is, is a controlled environment where you can execute malware in a controlled environment and then observe its behavior.
[07:41.880 --> 07:49.740]  And you... at the same time, you're able to run that particular file through static analysis tools.
[07:50.120 --> 07:58.240]  So, one of the things that dynamic analysis, you know, has is that it's very sexy.
[07:58.540 --> 08:03.240]  You get a lot of, you know, network indicators out of it.
[08:03.240 --> 08:09.520]  So, I kind of think that, you know, because it's sexy, it's something that you probably already know.
[08:09.680 --> 08:11.440]  So, I'm going to talk more right now.
[08:11.600 --> 08:15.920]  And I'm going to highlight some of the things that you can get from the static analysis components of Cuckoo.
[08:15.920 --> 08:27.200]  So, this is actually from a Mac OS piece of malware that this was... and you may have heard of this event.
[08:27.880 --> 08:35.920]  But there is a... there's a torrent downloader called Transmission.
[08:36.120 --> 08:41.340]  And the 2.90 version of Transmission was actually Mac malware.
[08:41.340 --> 08:50.140]  The adversary had, you know, basically pwned the, you know, transmissions systems.
[08:50.520 --> 08:54.520]  And so, Transmission was serving this particular piece of malware.
[08:54.800 --> 09:05.940]  So, when I want to reverse engineer this malware, one of the things that you need to do before you get to that stage is understand what Packer is being used by the adversary.
[09:05.940 --> 09:12.520]  And so, I have tools that I can look at this piece of malware and find out what Packer is being used.
[09:12.740 --> 09:15.900]  But I always like to find a shortcut and cheat.
[09:17.460 --> 09:19.780]  So, I ran this through strings.
[09:19.780 --> 09:22.840]  And you can see here that it's been packed with UPX.
[09:23.120 --> 09:26.740]  And in addition, it's been packed with a particular UPX version.
[09:26.740 --> 09:32.760]  So, of course, this data can be forged by the malware author.
[09:32.960 --> 09:34.980]  But, you know, I'm just going to say, like, maybe they're not.
[09:35.140 --> 09:38.200]  So, I'm going to try... and I've shortcutted my analysis process.
[09:38.200 --> 09:44.900]  So, I know the Packer that I need to use to look at this piece of malware and find the unpacked source code.
[09:45.020 --> 09:47.300]  And so, if you don't know what a Packer is...
[09:47.300 --> 09:50.700]  So, a Packer is a way to package software.
[09:50.940 --> 09:54.840]  And it's either encoded or encrypted.
[09:55.180 --> 09:56.900]  And so, the...
[09:56.900 --> 09:58.180]  When you run that...
[09:58.180 --> 10:05.340]  When you run a packed binary through a disassembler, you're only going to get the assembly code for the Packer.
[10:05.480 --> 10:07.860]  You're not going to get the actual executed code.
[10:07.880 --> 10:14.420]  Because that's actually contained in a encoded or encrypted area of the PE file.
[10:14.420 --> 10:20.100]  So, you need to know what Packer it is and then run it through an unpacker and then analyze the unpacked binary.
[10:21.100 --> 10:23.020]  So, again, this is the same binary.
[10:23.760 --> 10:28.800]  And I consider AV detections as a type of static analysis.
[10:28.800 --> 10:30.960]  Because you're not looking at the behavior of the malware.
[10:31.140 --> 10:32.360]  You're looking at the signatures.
[10:32.700 --> 10:36.400]  And so, one of the things that is very good about AV detection...
[10:36.400 --> 10:41.480]  Some AV engines do actually have very highly, you know, targeted signatures.
[10:41.480 --> 10:45.360]  And so, you run your binary through that.
[10:45.560 --> 10:50.200]  And you may get a head start as to what this thing is that you're looking at.
[10:50.320 --> 10:52.800]  And you can basically Google this.
[10:53.000 --> 10:54.340]  So, this is Key Ranger A.
[10:54.560 --> 11:01.000]  And so, you can get from the AV detections a head start on what it is that you want to analyze.
[11:01.500 --> 11:04.280]  So, I'm going to kind of change lanes here.
[11:04.280 --> 11:06.860]  And this is actually data about a PE file.
[11:06.980 --> 11:11.080]  We were just looking at a Mach O binary for Mac OS.
[11:11.540 --> 11:14.180]  And now we're going to look at a Windows binary.
[11:14.520 --> 11:17.160]  And so, Windows binary has certain features of it.
[11:17.360 --> 11:19.300]  Certain static features that you can analyze.
[11:19.720 --> 11:22.260]  And so, one of the things is PE sections.
[11:22.760 --> 11:25.380]  And so, this is the RSRC section.
[11:25.380 --> 11:37.480]  And because it's malware, if it were a, you know, a benign binary, the sections may actually correspond to things that are correct or usable.
[11:37.720 --> 11:40.660]  But sometimes, like, malware authors will just make things up.
[11:40.740 --> 11:44.560]  And so, the RSRC may not actually be a resource section.
[11:44.560 --> 11:47.540]  It may be something else the malware author wants to do.
[11:47.540 --> 11:53.040]  But, you can take an MD5 of that section using a sandbox.
[11:53.800 --> 11:56.580]  And then, you can take this section.
[11:56.700 --> 12:01.460]  You can pivot around in data sets in, you know, other malware that you've collected.
[12:01.620 --> 12:10.740]  And you can see what this section refers to that is the same as other pieces of malware that you've previously collected.
[12:11.060 --> 12:15.260]  And so, I found there are 52 files that are similar to this one.
[12:15.260 --> 12:21.620]  And so, now, I can then take those 52 files and compare and find other things that are similar.
[12:22.320 --> 12:30.280]  And see if there's any, like, you know, thread that connects these with a previous piece of malware.
[12:30.540 --> 12:35.460]  And then, therefore, figure out, like, what malware family it is, et cetera, et cetera.
[12:35.660 --> 12:37.640]  And so, also, resources.
[12:37.880 --> 12:39.020]  So, resources are another one.
[12:39.160 --> 12:41.380]  So, this is the RT underscore version.
[12:41.380 --> 12:52.260]  And, you know, taking the SHA-256 of this particular resource, I find 99 files that are the same as the PE that I'm looking at as my target.
[12:52.800 --> 12:56.500]  So, resources and sections are very similar.
[12:57.600 --> 13:01.560]  And this is... this is actually a really cool technique, by the way.
[13:01.740 --> 13:08.680]  So, what you're looking at here is the compilation or linking timestamp of the PE file.
[13:08.680 --> 13:11.140]  So, the PE file will have a timestamp.
[13:11.720 --> 13:14.060]  This can be stomped on by the adversary.
[13:14.300 --> 13:16.620]  So, it could say, like, zero.
[13:16.820 --> 13:17.520]  I've seen that a lot.
[13:17.540 --> 13:19.700]  So, it'll be, you know, January 1st, 1970.
[13:20.840 --> 13:25.240]  But, if they don't, you'll have the timestamp that they compiled and linked the binary.
[13:25.240 --> 13:39.320]  And so, what you can do is you can compare that timestamp to the time that something was submitted to, like, malware or VirusTotal or any of these things that you can submit files to.
[13:39.560 --> 13:46.120]  And adversaries submit files to these systems to see if the system is able to flag it as bad.
[13:46.120 --> 13:52.180]  And so, as you can see, you know, this was 941 and 34 seconds.
[13:52.180 --> 13:55.340]  And then it was submitted 942 and 47 seconds.
[13:55.740 --> 14:02.120]  It is, I would say, impossible for this to go and infect someone and come back.
[14:02.440 --> 14:10.520]  So, what you get here is I know the submitter to VirusTotal of this particular file.
[14:10.520 --> 14:19.220]  And so, from now on, I can watch the submitter hash at VirusTotal and find every single file that this malware author submits.
[14:19.360 --> 14:20.440]  And I know that it's bad.
[14:21.900 --> 14:24.300]  So, Cuckoo Sandbox comes in a number of flavors.
[14:24.300 --> 14:25.360]  It has plain vanilla.
[14:25.540 --> 14:26.980]  This is the current stable version.
[14:27.140 --> 14:28.580]  There's a next generation right now.
[14:28.820 --> 14:31.260]  Release Candidate 1 of 2.0 is out.
[14:31.520 --> 14:36.240]  There's also Cuckoo Modified, which has a bunch of features that we'll go into in just a moment.
[14:36.240 --> 14:42.580]  So, Cuckoo Modified does normalization of file and registry paths.
[14:42.760 --> 14:44.020]  So, this is actually really important.
[14:44.060 --> 14:45.940]  And I'm going to talk about this in just a moment.
[14:46.140 --> 14:49.120]  It also does 64-bit analysis, service monitoring.
[14:49.600 --> 14:51.180]  It has an extended API.
[14:51.180 --> 14:54.080]  You can do Tor for outbound network connections.
[14:54.180 --> 14:56.260]  And it has a Malheur integration.
[14:57.440 --> 14:59.680]  But, why is normalization important?
[14:59.940 --> 15:05.160]  So, if you're doing data analysis across a lot of data sets...
[15:05.160 --> 15:07.420]  And so, some of the people that you work with...
[15:07.420 --> 15:09.580]  Like, you know, in the malware analysis community...
[15:09.580 --> 15:12.160]  I get data from other people that do malware analysis.
[15:12.440 --> 15:17.260]  And so, they may actually be using a different flavor of Windows for their VM than I am.
[15:17.480 --> 15:19.260]  And so, the top and the bottom...
[15:19.740 --> 15:20.640]  And I apologize.
[15:20.840 --> 15:22.840]  I don't remember which one is Windows 7 and XP.
[15:23.140 --> 15:26.320]  But one of these strings is Windows 7 and the other is XP.
[15:26.320 --> 15:28.500]  And so, obviously, these...
[15:28.500 --> 15:31.780]  You can't do analysis across a lot of sandboxes with this.
[15:31.960 --> 15:37.940]  But, if you normalize the data and replace that with an environment variable, app data...
[15:37.940 --> 15:43.420]  You can now do analysis across a number of different sandbox flavors...
[15:44.400 --> 15:45.720]  Depending, you know...
[15:45.720 --> 15:49.800]  But not depending on the type of Windows that was used.
[15:50.000 --> 15:53.000]  So, this is really important if you're getting data from a lot of different sources.
[15:54.760 --> 15:58.440]  So, Cuckoo Next Generation, this 2.0, has a lot of new features.
[15:58.680 --> 16:01.860]  Mac OS X, Linux, Android, or both...
[16:01.860 --> 16:04.180]  All of these are sandboxable.
[16:04.480 --> 16:10.440]  Has Suricata, Snort, Moloch integration, SSL decryption, VPN support.
[16:10.560 --> 16:15.240]  So, if you need to go from a different specific country or hide your traffic, you can go from a VPN.
[16:16.420 --> 16:19.840]  64-bit analysis and the new version of Cuckoo is awesome.
[16:20.640 --> 16:24.440]  So, what if your malware is VM-aware?
[16:24.820 --> 16:27.040]  So, there's two things that you can do to prevent...
[16:27.040 --> 16:32.800]  Or to protect yourself or help yourself analyze VM-aware malware.
[16:33.160 --> 16:34.700]  So, one is Paranoid Phish.
[16:34.940 --> 16:42.760]  So, Paranoid Phish takes the perspective of figuring out what malware in the wild uses to detect.
[16:42.760 --> 16:48.040]  Whether it's being debugged, whether it's in a VM, whether it's being...
[16:48.040 --> 16:49.800]  You know, whether it's in a sandbox.
[16:50.160 --> 16:56.900]  And so, what it'll do is it has all these operationalized in an executable that you run through your sandbox.
[16:57.220 --> 17:00.420]  And then it'll tell you, I found X, Y, and Z.
[17:00.640 --> 17:03.420]  And then these are the things that you need to correct to improve your sandbox.
[17:04.200 --> 17:10.800]  VM-Cloak is another piece of software that's actually authored by one of the authors of Cuckoo Sandbox.
[17:11.620 --> 17:15.140]  And what it does is it takes a different perspective.
[17:15.380 --> 17:19.400]  What it does is it actually, you know, automatically builds your VM.
[17:20.340 --> 17:29.140]  And it also obfuscates all of the things that something like Paranoid Phish or malware will look for to find out if it's in a VM.
[17:29.360 --> 17:37.780]  And so, it creates these automated VMs that you can use with Cuckoo that are protected from many of the anti-analysis techniques.
[17:38.820 --> 17:41.300]  So, Cuckoo has a number of different outputs.
[17:41.780 --> 17:43.420]  HTML, JSON, blah, blah, blah.
[17:43.720 --> 17:45.960]  So, it has dropped files.
[17:46.240 --> 17:51.200]  And you want to, you know, if there's a dropped file, often you want to re-sandbox that dropped file.
[17:51.480 --> 17:57.280]  It'll produce PCAP, which you can analyze with the software that I'm going to talk about in just a moment.
[17:57.760 --> 17:59.300]  And then memory images.
[17:59.300 --> 18:03.760]  But there's a nuance to Cuckoo's memory image that it produces.
[18:04.400 --> 18:08.780]  So, it uses techniques that basically dirty the memory image.
[18:08.960 --> 18:15.160]  So, the memory image that Cuckoo produces is good for Cuckoo's own analysis of it.
[18:15.160 --> 18:23.380]  But, I suggest that you need to create a clean memory image to use volatility on it separately from Cuckoo.
[18:23.660 --> 18:28.780]  And it also produces visited URLs that you would want to look at with Thug.
[18:29.700 --> 18:31.180]  So, let's look at Thug.
[18:31.360 --> 18:33.460]  Thug is a low interaction honey client.
[18:33.600 --> 18:34.540]  And what is that?
[18:34.920 --> 18:36.540]  It pretends to be a browser.
[18:36.540 --> 18:38.660]  It's triggered by a drive-by download.
[18:39.160 --> 18:41.380]  Or, you know, it...
[18:41.380 --> 18:46.440]  You would feed it a URL that has just a malware payload download.
[18:47.220 --> 18:51.520]  And the goal is to capture the payload so that you can analyze it...
[18:51.520 --> 18:52.240]  Excuse me.
[18:52.340 --> 18:53.060]  Analyze it further.
[18:54.040 --> 18:58.580]  So, Thug is a wolf in chief clothing because it is entirely written in Python.
[18:58.960 --> 19:05.960]  And it basically pretends to be any type of browser you'd like via user agent strings.
[19:05.960 --> 19:07.840]  And then it also feeds...
[19:07.840 --> 19:12.220]  You know, it has V8 as the JavaScript engine.
[19:12.400 --> 19:19.000]  And so, it will actually feed the drive-by download the correct version, you know, that you've...
[19:19.000 --> 19:23.760]  That you've told it of Java, PDF, Flash, etc.
[19:24.040 --> 19:32.000]  And so, it pretends to be the version of Java or whatever that that drive-by wants to infect you with.
[19:33.480 --> 19:35.980]  So, there are a number of available user agents.
[19:36.140 --> 19:37.520]  And it ranges from Windows.
[19:37.520 --> 19:42.160]  It includes, you know, Android devices, iOS, iPads.
[19:42.500 --> 19:47.320]  And so, you know, it has a wide range of things that you can pretend to be.
[19:48.560 --> 19:52.480]  So, the output of Thug, it has payload files.
[19:52.660 --> 19:56.920]  And that's like the, you know, that's the gold that you're getting out of this.
[19:57.300 --> 20:01.800]  And you would use Cuckoo to then look at those payload files and execute them.
[20:02.120 --> 20:03.780]  It has other content files.
[20:03.900 --> 20:05.160]  It shows you the visit URLs.
[20:05.520 --> 20:08.540]  It has a number of different output formats.
[20:08.540 --> 20:11.660]  And it has its own native output format.
[20:13.320 --> 20:15.960]  So, now, this is like my...
[20:15.960 --> 20:18.460]  Honestly, this is my favorite part of this talk.
[20:18.660 --> 20:19.860]  Because I love Bro.
[20:20.440 --> 20:22.420]  I know that many of you love Bro.
[20:22.420 --> 20:25.240]  Because you do use it as a network security monitoring tool.
[20:25.440 --> 20:31.220]  But if I may, I would love to convert you into loving it as a malware analysis tool.
[20:31.220 --> 20:41.220]  So, the difference here is that the Bro that you would use in network security monitoring, you're looking at a large amount of traffic for...
[20:41.920 --> 20:44.400]  You're looking for bad things in a large amount of traffic.
[20:44.600 --> 20:50.200]  I am actually executing a piece of malware and only looking at the traffic that piece of malware produces.
[20:52.680 --> 20:55.800]  So, Bro can do two types of packet capture.
[20:55.960 --> 20:58.480]  It can do live packet capture.
[20:58.480 --> 21:01.880]  It can also look at recorded packet capture, which is a PCAP.
[21:02.100 --> 21:06.640]  So, a PCAP is a recording of network traffic from two points in time.
[21:08.140 --> 21:10.140]  Bro is made up of a number of scripts.
[21:10.440 --> 21:13.160]  It allows you to write your own scripts if you want.
[21:13.680 --> 21:20.640]  But, by the way, the talk that I'm giving here, I'm only using the scripts that are built into Bro.
[21:22.520 --> 21:25.460]  So, I want to take a little exercise here.
[21:25.460 --> 21:31.760]  And look at what can I learn from a PCAP only.
[21:32.320 --> 21:37.720]  And so, I kind of conceptualized this as having the malware in a different room.
[21:37.720 --> 21:42.320]  And I can't look at the malware file itself, but I can kind of listen to what it's doing.
[21:42.720 --> 21:45.860]  And so, what can I learn from PCAP only?
[21:46.020 --> 21:48.500]  And this is the SHA-1 of what we're going to look at.
[21:48.500 --> 21:49.520]  And that's where I got it.
[21:49.820 --> 21:50.580]  Hybrid analysis.
[21:50.940 --> 21:51.960]  Good friends of ours.
[21:52.500 --> 21:57.260]  And so, you can download this piece of malware yourself.
[21:57.580 --> 22:02.920]  And you can, you know, look at what I've done and validate it.
[22:03.360 --> 22:07.400]  So, first thing you want to look at is the con log.
[22:07.740 --> 22:12.900]  So, this is a log of all the connections that are made that Bro has observed in that PCAP.
[22:12.900 --> 22:16.240]  So, there's a variety of things going on here.
[22:16.460 --> 22:19.220]  So, I kind of want to split this out into different categories.
[22:19.540 --> 22:22.020]  And so, the first category is the garbage.
[22:22.360 --> 22:25.520]  So, the garbage is stuff that you don't want to care about.
[22:25.660 --> 22:30.540]  This is stuff that is, you know, benign traffic that your operating system is producing.
[22:30.780 --> 22:32.400]  So, we throw away this stuff.
[22:33.340 --> 22:34.860]  Then we have DNS traffic.
[22:34.860 --> 22:37.480]  So, this is very good, rich data.
[22:37.660 --> 22:45.860]  So, we want to look at DNS resolutions because this is the malware asking for the IP address of the domain name that it's reaching out to.
[22:47.580 --> 22:49.860]  These are HTTP requests.
[22:50.540 --> 22:54.080]  And so, this is something going on via HTTP.
[22:54.400 --> 22:55.760]  We'll look into what that is.
[22:56.340 --> 23:01.480]  And then these, where the service is a dash, I like to call this the WTF traffic.
[23:01.480 --> 23:07.500]  This is the stuff that is definitely C2 command and control traffic because it...
[23:07.500 --> 23:08.740]  Bro is very smart.
[23:08.980 --> 23:12.600]  And if Bro doesn't know what the service is, probably bad.
[23:14.040 --> 23:18.200]  And so, by the way, this is a Word document.
[23:18.360 --> 23:26.040]  So, if your Word document is reaching out to the internet and making queries on HTTP, then your macaroni is infected.
[23:29.880 --> 23:32.500]  So, let's look at the DNS log first.
[23:32.500 --> 23:38.400]  And so, like I said earlier, Bro's output is made up of a number of text-based logs.
[23:38.600 --> 23:40.000]  And so, this is one.
[23:40.240 --> 23:44.500]  And the incantation that I have at the top is...
[23:45.080 --> 23:51.280]  And these are all going to be published in my GitHub, which I'll show you the link for in a moment.
[23:51.760 --> 23:58.000]  But these incantations will boil down the Bro logs to just what you want.
[23:58.000 --> 24:02.960]  And so, here we have a number of different DNS queries.
[24:03.320 --> 24:06.900]  And so, this, again, this is like the good traffic.
[24:07.120 --> 24:08.700]  Obviously, reaching out to Google.
[24:09.200 --> 24:10.660]  Google is probably not a C2.
[24:11.220 --> 24:12.980]  Microsoft, also not a C2.
[24:13.300 --> 24:17.260]  But here we have traffic that we want to analyze.
[24:17.560 --> 24:21.400]  So, these are some indicators that we want to kind of put in our back pocket and think about.
[24:21.400 --> 24:25.820]  And also, you know, thinking about this from the automation perspective.
[24:25.820 --> 24:30.020]  These are the things that you want to kind of set aside when you're automating things.
[24:32.900 --> 24:42.660]  So, and I will not name names, but there are certain nonprofit organizations that changed their tune and now sell what they were giving away in the past.
[24:42.660 --> 24:47.660]  So, I'm going to give you a way to do poor man's pDNS.
[24:48.560 --> 24:54.060]  So, passive DNS is what domain names have been resolved to a particular IP address.
[24:54.640 --> 24:58.440]  And so, this is, you know, the...
[25:00.200 --> 25:00.900]  Hold on.
[25:01.060 --> 25:01.300]  Sorry.
[25:04.060 --> 25:05.860]  Make this a little easier to see.
[25:05.860 --> 25:09.540]  So, this is IP 50, 62, blah, blah, blah.
[25:10.060 --> 25:13.040]  And, you know, there's the word Google dork.
[25:13.300 --> 25:14.940]  But this is actually a Bing dork.
[25:15.200 --> 25:24.100]  So, Bing, you can use to find everything that Bing has seen that is on this particular IP address.
[25:24.100 --> 25:25.980]  So, this is poor man's pDNS.
[25:26.280 --> 25:34.460]  So, I can see that many, many domain names have resolved during Bing's, you know, crawling history to this particular IP address.
[25:34.460 --> 25:39.900]  So, this leads me to believe that this is a compromised IP address.
[25:40.280 --> 25:42.660]  So, let's look at the WHOIS data.
[25:42.880 --> 25:47.020]  And so, we go to domain tools, another tool, you know, site that I really love.
[25:47.340 --> 25:54.580]  And this hookedoutdoors.com, we can see the creation date is 2007.
[25:55.100 --> 26:00.980]  So, chances are malware C2s that are owned by the adversary are not created in 2007.
[26:01.660 --> 26:03.280]  This is probably compromised.
[26:04.220 --> 26:06.780]  So, I look at the site content.
[26:07.880 --> 26:11.820]  And, you know, this is someone's, you know, fishing lure site, whatever.
[26:12.140 --> 26:18.220]  But, something that's interesting is I see that it's got that little fav icon for Drupal.
[26:18.420 --> 26:23.280]  So, I have a pretty good idea of how the adversary got into this particular website.
[26:26.120 --> 26:29.280]  So, let's move on and look at the rest of the DNS log.
[26:29.480 --> 26:36.450]  So, we've got the, you know, hookedoutdoors and then we have this dinttobogo.com and then aswebcoms.com.
[26:36.920 --> 26:43.440]  And if any of you are, you know, hardcore malware analysis or threat intel people, you know exactly what we're looking at here.
[26:43.440 --> 26:45.200]  But, we will get there.
[26:46.460 --> 26:49.480]  So, we're going to look at the next IP address.
[26:49.640 --> 26:53.300]  And by the way, this is the dinttobogo.com IP address.
[26:53.420 --> 26:58.240]  77.246 has no poor man's pdns.
[26:58.580 --> 27:01.120]  So, this is not a shared web server.
[27:01.120 --> 27:02.700]  This is a single IP address.
[27:02.980 --> 27:09.860]  So, you know, this is something that, you know, leads me to think that there's something more nefarious going on here.
[27:10.980 --> 27:16.960]  So, I look at the WHOIS data and lo and behold, this was created on the 12th of this month.
[27:17.580 --> 27:29.540]  And then we've got a registered email address where we can actually dig into what this email address is and what's going on here.
[27:30.180 --> 27:33.760]  But, this registrar is BizCN China.
[27:34.340 --> 27:41.880]  And, you know, we've got Polish, you know, I don't mean to be, you know, singling out anyone.
[27:42.080 --> 27:45.040]  But, East Europe is, you know, a font of malware.
[27:45.380 --> 27:49.720]  So, we're looking at something that is probably a little bit more suspicious.
[27:51.240 --> 27:54.640]  So, I look at poor man's reverse WHOIS.
[27:55.640 --> 28:00.020]  And so, I Googled the email address.
[28:00.240 --> 28:09.140]  And so, lo and behold, like, you know, the top three here are from ThreatCrowd, ThreatMiner, and ScamWarners.com.
[28:09.260 --> 28:11.400]  So, I think there's definitely something going on here.
[28:12.100 --> 28:16.080]  So, I look at the site content and there's nothing there.
[28:16.420 --> 28:17.120]  Imagine that.
[28:17.340 --> 28:18.240]  You know, your C2.
[28:18.440 --> 28:20.620]  Why put content on your C2?
[28:21.980 --> 28:24.220]  So, let's go back to the DNS log.
[28:24.480 --> 28:26.020]  And let's move to the next part.
[28:26.260 --> 28:28.580]  And look at ASWebcoms.com.
[28:28.680 --> 28:30.020]  This is where it gets very interesting.
[28:30.260 --> 28:36.980]  And you'll see there were two requests for resolution of ASWebcoms.
[28:37.320 --> 28:42.360]  And both of them, and I know this looks a little bit like, you know, number salad for you.
[28:42.360 --> 28:45.880]  But these are the same three IP addresses and they're just rotated.
[28:46.220 --> 28:49.080]  So, you know, this looks like...
[28:49.080 --> 28:52.100]  This looks like something fairly nefarious.
[28:52.300 --> 28:54.680]  Or this looks like a legitimate website.
[28:55.160 --> 29:02.260]  You know, there are legitimate websites that want to have, you know, backup IP addresses and then do round-robin DNS among them.
[29:02.520 --> 29:05.960]  So, I'm gonna go with it not being legitimate.
[29:06.920 --> 29:14.600]  So, we look at the WHOIS data and the creation date is on the 16th of this month.
[29:14.800 --> 29:20.620]  So, by the way, things that are created within the past month are things that are suspicious to me.
[29:22.220 --> 29:29.880]  Also, Sancha at ASWebcoms.com, the registrant address, I will, you know, kind of put that in my back pocket.
[29:29.880 --> 29:38.600]  But now, I'm thinking because this is looking like something that is not legitimate, I want to look at the name server.
[29:38.780 --> 29:41.420]  So, I want to keep those name servers in my back pocket.
[29:41.780 --> 29:48.520]  And, you know, there are... and by the way, like I'm saying, there, you know, everything I'm talking about is free access.
[29:48.880 --> 29:57.640]  But there are services out there that can find domains that are from this particular DNS service.
[29:57.640 --> 30:06.840]  So, I won't go into those, but, you know, if you want to look at reverse name server, probably there's some nasty stuff that comes out of this Triumverde.com.
[30:08.800 --> 30:14.520]  So, we've got, you know, we've got a number of things that I want to do, but one thing is pDNS.
[30:14.800 --> 30:16.940]  And, like I said, free services.
[30:16.960 --> 30:18.060]  You can go to our website.
[30:18.060 --> 30:18.940]  This is all free.
[30:19.080 --> 30:20.060]  This is in our common community.
[30:20.220 --> 30:25.220]  So, I've loaded this IP address in, you know, our pDNS service.
[30:26.260 --> 30:35.850]  And I find down here, all of these are, you know, July 13th, 2016.
[30:36.270 --> 30:37.750]  July 16th, 2016.
[30:38.110 --> 30:45.830]  And all of these are kind of, you know, red flag-ish domain names like EJDQZKD.
[30:46.790 --> 30:48.850]  Sounds like a domain generation algorithm to me.
[30:49.570 --> 30:52.710]  Also, L, N, X, Y, blah, blah, blah.
[30:53.010 --> 31:00.790]  And then, they were registered July 13th, July 16th, 13th, 13th, 19th, 17th, 19th, 14th, 19th, and 13th.
[31:02.230 --> 31:03.410]  All of this is bad.
[31:03.970 --> 31:07.970]  You know, just, I would flag all of this.
[31:08.230 --> 31:12.470]  So, let's move on to the next, like, stage of Bro.
[31:12.470 --> 31:15.350]  So, you're looking at also the HTTP D log.
[31:15.910 --> 31:21.090]  And so, Bro will not only show you the connections, it'll show you deeper into the network stack.
[31:21.430 --> 31:24.930]  And show you, you know, HTTP connections.
[31:25.230 --> 31:28.550]  And so, we've got this set of HTTP connections.
[31:29.650 --> 31:38.010]  And so, we're looking here at 77, blah, blah, blah, at dinttobogo.com, zapoygate.php.
[31:38.190 --> 31:45.890]  So, being a Russophile and, you know, fluent in Russian, I know the word zapoy.
[31:46.750 --> 31:58.890]  So, zapoy is a term used in Russia and other post-Soviet states to describe alcohol abuse behavior resulting in two or more days of continuous drunkenness.
[31:59.030 --> 32:03.910]  So, I would imagine that most of us are on a zapoy at the moment.
[32:04.770 --> 32:08.370]  But, this is something to actually put in your back pocket and think about.
[32:08.490 --> 32:12.630]  Because now we know that the adversary is probably rissophone.
[32:14.590 --> 32:15.790]  And, oh, sorry.
[32:16.250 --> 32:22.790]  And, by the way, so, I'm on some secret squirrel, you know, lists, fight club sort of things.
[32:22.790 --> 32:26.330]  And I had to reach out to some friends and get some more information.
[32:26.770 --> 32:33.490]  And so, from people that I can't cite, zapoygate.php is an indicator of Pony.
[32:33.670 --> 32:39.790]  So, Pony is a loader module and a password stealer and a malware family.
[32:41.470 --> 32:45.190]  Again, let's look at the next piece of HTTPd logs.
[32:45.330 --> 32:50.450]  And I know we're skipping over that install exe, but that's really cool stuff.
[32:50.610 --> 32:51.270]  We'll come back to that.
[32:51.270 --> 32:55.310]  But, so, this is sort of a random string slash index.php.
[32:56.750 --> 33:01.150]  And, lo and behold, those same secret squirrel friends of mine say this is nymame.
[33:01.330 --> 33:01.710]  Alright?
[33:02.110 --> 33:04.210]  So, nymame plus Pony.
[33:04.470 --> 33:06.090]  We're gonna see this in a moment.
[33:06.250 --> 33:07.090]  We're gonna see...
[33:07.090 --> 33:16.150]  We're actually gonna go from understanding what this is to finding out, kind of, not necessarily who the adversary is, but knowing who the adversary group is.
[33:17.630 --> 33:20.010]  So, we're gonna look at these now.
[33:20.130 --> 33:20.890]  These are really fun.
[33:21.150 --> 33:25.910]  So, inst1.exe are both at Hooked Outdoors.
[33:26.190 --> 33:28.350]  And so, remember, this is a compromised website.
[33:28.670 --> 33:32.270]  And so, this is how they're serving their executables, their payloads.
[33:33.750 --> 33:36.410]  And so, let's look at the first one.
[33:36.410 --> 33:39.790]  So, this is the log from Bro called the PELog.
[33:40.290 --> 33:43.030]  PELog gives you some really good information.
[33:43.330 --> 33:47.910]  So, by the way, you'll see here, there's the F8K, that first one.
[33:48.390 --> 33:56.230]  This is the awesome thing about Bro, is it will allow you to connect log from log using UIDs, or IDs.
[33:56.230 --> 34:07.110]  And so, that F8K ID is findable in other logs, and I can grep for that particular UID.
[34:07.350 --> 34:14.190]  And I can see, in the PELog, the line in that PELog that refers to that particular file.
[34:14.410 --> 34:16.610]  So, we can see here, it's a Windows GUI.
[34:16.950 --> 34:18.830]  We get a few section names.
[34:19.010 --> 34:21.530]  We also get the compile timestamp.
[34:21.930 --> 34:23.770]  So, all very good information.
[34:24.690 --> 34:27.030]  So, now, let's look at the files log.
[34:27.290 --> 34:30.890]  And so, anything that is a file will be put into the files log.
[34:31.030 --> 34:36.510]  And so, I can, if you look in the incantation, those two particular UIDs are in there.
[34:36.650 --> 34:45.330]  And so, I'm looking at the UIDs for this one, and I get out of the files log, I get all the file hashes, and then the total bytes for these files.
[34:46.690 --> 34:52.150]  So, this is the point where we kind of back away from using the tool, and we do some open source intelligence.
[34:52.150 --> 34:59.430]  And I've got, you know, Nymame, Pony, and, you know, Now, within the past month.
[34:59.610 --> 35:07.070]  So, I go look around and see if other people, you know, other people that do what I do, are talking about what I'm looking at.
[35:07.070 --> 35:20.010]  And, lo and behold, so the Man1 Cryptor Gang, these are variously known as Vautrak, the Vautrak Gang, NeverQuest.
[35:20.190 --> 35:24.350]  You might be familiar with all of them, but they use all of these things together.
[35:24.630 --> 35:34.770]  And so, you know, ThreatGeek.com, which is Fidelis Cybersecurity's blog, wrote a really good review of all of this stuff.
[35:34.770 --> 35:42.590]  So, now I have not only the stuff that I'm looking at, and now I have some open source intelligence that I can compare my results to.
[35:43.090 --> 35:45.930]  And, by the way, we haven't left a PCAP yet.
[35:47.990 --> 35:50.210]  So, what can you learn from PCAP only?
[35:50.370 --> 35:52.430]  So, we know that the adversary is likely Rysaphone.
[35:52.990 --> 35:55.890]  You have an office document generating network traffic.
[35:56.030 --> 35:57.590]  By the way, your macaroni is infected.
[35:58.250 --> 36:03.750]  We have multi-stage malware, because it has different things that it's installing.
[36:04.410 --> 36:07.190]  One of the payloads we know now is Pony.
[36:07.570 --> 36:09.990]  One of the payloads is NyMame.
[36:10.830 --> 36:14.250]  NyMame, we also know from looking at the infrastructure.
[36:14.450 --> 36:18.490]  We know that it has dedicated infrastructure, and it contains a rogue DNS server.
[36:18.950 --> 36:22.530]  The dropper uses compromised Drupal websites.
[36:22.530 --> 36:29.550]  And, you know, by doing a little bit of due diligence, we've found that the adversary is man one.
[36:31.130 --> 36:36.330]  So, we've collected a lot of indicators, and I'll zoom in on these for you.
[36:37.770 --> 36:38.590]  I think.
[36:38.750 --> 36:39.590]  I think I can.
[36:39.870 --> 36:41.410]  So, we've got a lot of indicators.
[36:41.610 --> 36:43.170]  We've got a bunch of URLs.
[36:43.170 --> 36:43.790]  We...
[36:43.790 --> 36:45.210]  And we have a bunch of...
[36:46.350 --> 36:48.190]  Oh, that didn't work.
[36:48.330 --> 36:48.570]  Sorry.
[36:50.470 --> 36:53.890]  So, we have a bunch of indicators that we've collected from just the PCAP.
[36:54.050 --> 37:00.470]  And this is a very good, you know, image of what the malware is doing, without actually looking at the malware itself.
[37:01.550 --> 37:05.890]  So, of course, I want to help you do what I do.
[37:06.130 --> 37:09.990]  And so, local.bro is the configuration file for bro.
[37:09.990 --> 37:19.970]  And so, these are... and I spent a lot of time going over how to do the best configuration file possible for malware analysis.
[37:20.150 --> 37:20.850]  So, this is here.
[37:20.950 --> 37:24.290]  And I know, you know, that's a lot of word salad.
[37:24.690 --> 37:26.970]  But, there it is.
[37:27.130 --> 37:30.910]  So, I am working on publishing the entire system.
[37:32.370 --> 37:40.970]  But, some of the components, including my local bro, which people have requested because they want to work on it now, that's available right there.
[37:42.530 --> 37:47.290]  So, of course, I am curious about what actually happened.
[37:47.510 --> 37:48.290]  So, we're going to cheat.
[37:48.570 --> 37:59.070]  And not necessarily cheat, but in the context of an open source malware lab, what I'm talking about is sending that particular file over to Cuckoo to see what's happening there.
[37:59.070 --> 38:02.470]  And so, this is the dropper.
[38:02.670 --> 38:05.230]  And so, the dropper is cuddlesome.exe.
[38:05.330 --> 38:12.750]  And it's a ruck gov dropper, which also reinforces the fact that it's man one.
[38:13.390 --> 38:18.670]  So, bro output, you have con log, DNS log, HTTP, blah, blah, blah.
[38:19.030 --> 38:20.530]  You get extracted files.
[38:20.790 --> 38:27.010]  Also, you can change the output to have JSON so that you can consume it with Elasticsearch very easily.
[38:27.810 --> 38:29.590]  Now, we're going to move to volatility.
[38:31.010 --> 38:34.550]  And volatility, another favorite tool of mine, very awesome.
[38:35.450 --> 38:36.850]  So, what is volatility?
[38:37.210 --> 38:41.190]  So, volatility extracts artifacts from samples of volatile memory.
[38:41.970 --> 38:43.050]  Hence, volatility.
[38:43.430 --> 38:47.230]  So, it gives you an amazing view into what the malware is doing.
[38:47.410 --> 38:54.830]  And like I said, where, you know, you're holding the cup against the wall and listening to what the malware is saying when you're looking at a PCAP.
[38:55.930 --> 39:00.210]  Volatility allows you to look at what the malware is thinking.
[39:00.310 --> 39:02.590]  Because it's using memory pages.
[39:02.890 --> 39:05.550]  And you're looking at what it has saved to memory.
[39:06.630 --> 39:10.150]  So, it has, you know, all the major operating systems support.
[39:10.290 --> 39:12.450]  Windows, macOS, Linux, blah, blah, blah.
[39:13.250 --> 39:21.850]  And then, what I want to do is kind of lead you down the same, you know, process that I did with Bro and look at volatility in action.
[39:22.030 --> 39:28.730]  By the way, if you receive a file that is a single letter or number.exe, it's malware.
[39:32.390 --> 39:34.010]  So, this is the SHA-1.
[39:34.150 --> 39:36.130]  You can follow along again with my analysis.
[39:37.270 --> 39:48.490]  And by the way, you know, one of the things I like to do is I, when I look at stuff like this, I beat my head against a brick wall trying to figure out when things don't work.
[39:48.650 --> 39:51.950]  And so, I don't want you to beat your head against the same brick wall.
[39:52.150 --> 40:01.290]  So, if you use VirtualBox, these are the incantations that you need to use to dump a memory image from VirtualBox and have it usable with volatility.
[40:02.190 --> 40:03.930]  These slides will be published.
[40:04.210 --> 40:07.210]  So, you know, no need to memorize it now.
[40:09.810 --> 40:16.450]  So, PSList and PSScan are tools that you can use to look at the processes that are running in a memory image.
[40:16.590 --> 40:21.170]  And so, what I did was I took a memory image of the clean VM.
[40:21.410 --> 40:26.150]  And then I compared it to a memory image of the VM after the malware had run.
[40:26.150 --> 40:36.530]  And so, there's a point here where the top one, you know, search protocol, search filter, service host, these are things that are naturally occurring in an operating system.
[40:36.670 --> 40:42.090]  But I double-clicked on a piece of malware and it wasn't Internet Explorer.
[40:42.290 --> 40:44.010]  But now, Explorer.exe is running.
[40:44.310 --> 40:46.430]  So, something is going on.
[40:47.370 --> 40:54.190]  So, what next thing you want to do is use MalFind, which is a plug-in for volatility.
[40:54.190 --> 41:01.170]  And all the things that I'm talking about right now, all of these come with the default standard version of this software.
[41:01.410 --> 41:13.350]  So, I'm looking at MalFind and I can find two processes that MalFind is telling me have been injected with, you know, executable that isn't that thing.
[41:13.350 --> 41:19.310]  So, what you can do is dump those processes into a file.
[41:19.590 --> 41:24.190]  And then what I did was I actually ran those dumped files through Cuckoo.
[41:24.450 --> 41:34.130]  And I found via AVScanner results, both of these processes are flagged as malware for a variety of reasons.
[41:34.130 --> 41:39.970]  So, the next thing I want to do is look at the NetScan.
[41:40.230 --> 41:47.130]  So, NetScan can look at the memory image and find out what network connections have been made outbound.
[41:47.810 --> 41:50.370]  So, we see here Explorer.exe.
[41:50.790 --> 41:52.810]  And by the way, I didn't run Explorer.
[41:53.370 --> 41:58.890]  But it reached out to these two times the same IP address on port 80.
[41:59.710 --> 42:01.190]  So, that's bad.
[42:02.310 --> 42:03.850]  So, what can we learn?
[42:03.970 --> 42:05.030]  What have we learned from this?
[42:05.350 --> 42:08.030]  We've learned that the sample uses process injection.
[42:09.010 --> 42:11.290]  We know what it targets.
[42:11.550 --> 42:13.270]  So, it targets Explorer.exe.
[42:13.430 --> 42:16.290]  And we've also pulled out a command and control IP address.
[42:17.750 --> 42:19.230]  So, volatility's output.
[42:19.510 --> 42:25.690]  You know, you get files from extracted services, from injection, DLL extracted, IP addresses.
[42:26.530 --> 42:30.390]  This one, so, IE history is interesting.
[42:30.590 --> 42:40.630]  So, I can actually see the history of all of the URLs that a user or malware has visited if they are using IE.
[42:41.250 --> 42:44.630]  So, a URL is extracted from the malware configuration.
[42:45.070 --> 42:51.030]  So, the malware config, if it's loaded into memory, I can pull URLs out of that.
[42:51.030 --> 42:53.270]  And then, also suspicious mutexes.
[42:53.970 --> 42:58.090]  And, by the way, I mean, volatility, it's like turtles all the way down into infinity.
[42:58.330 --> 43:00.070]  There's so much stuff that you can get out of it.
[43:00.250 --> 43:04.830]  Like, I could have a 20-hour talk about volatility alone.
[43:05.370 --> 43:07.310]  But there's so much more stuff that you can get.
[43:07.450 --> 43:09.050]  But these are some of the major things.
[43:10.030 --> 43:18.450]  So, tying it all together, the... and by the way, so I've made a few swimlanes here.
[43:18.630 --> 43:23.490]  And I wanted, originally, to have all four tools in one set of swimlanes.
[43:23.990 --> 43:33.170]  But when you throw all of these together, the spaghetti starts to confuse the swimlanes.
[43:33.170 --> 43:37.250]  So, what I've done here is done Cuckoo Sandbox.
[43:37.530 --> 43:41.190]  And so, you upload a file to Sandbox.
[43:41.370 --> 43:42.150]  You do the analysis.
[43:42.970 --> 43:46.330]  You send all of your indicators to your threat intelligence platform.
[43:46.510 --> 43:51.730]  And you have a thug instance, which will process any of the URLs that come out of Cuckoo.
[43:51.930 --> 43:55.250]  You have bro that will process PCAP that comes out of Cuckoo.
[43:55.730 --> 44:04.110]  And if you have seen the file before, you want to say no, and then send your data to your threat... to your tip.
[44:04.350 --> 44:09.790]  And if you haven't seen the file before, you want to kind of go back to the top and throw it into the top of the hopper.
[44:10.210 --> 44:12.830]  And then, this is the same thing with volatility.
[44:13.570 --> 44:17.470]  And kind of conceptually, marry these two together with the same concept.
[44:17.730 --> 44:23.870]  And I know, like, you know, upload URL has a little piece of spaghetti that I was unable to kind of, you know, do right.
[44:24.650 --> 44:36.990]  But basically, you are taking the inputs and outputs that one particular tool uses, and if you have seen that particular thing before, you want to just consume the data that comes out.
[44:37.170 --> 44:40.710]  And if you haven't seen it before, you want to process it with another tool.
[44:40.710 --> 44:43.710]  And, by the way, one nuance here.
[44:44.310 --> 45:02.590]  If you see a file that drops a file, that drops a file, that drops a file, you want to actually have a stop at, like, I choose six generations of drop, because you can cause an infinite loop and kind of, you know, gum up your cuckoo instance.
[45:03.810 --> 45:11.510]  So, for orchestration and automation, you know, it's up to you what flavor of message queue you like.
[45:12.170 --> 45:17.850]  Redis, RabbitMQ, I use ZeroMQ because it's awesome.
[45:18.410 --> 45:31.690]  And then, also, like, you know, the concept of hitting your head against a brick wall, in one of my other projects, PlagueScanner, I ran into the brick wall of using ZeroMQ to transmit files.
[45:31.690 --> 45:32.850]  Don't do that.
[45:33.050 --> 45:40.870]  What you should do is use Nginx, dump the files to Nginx, and then serve them out using that web server.
[45:41.090 --> 45:49.430]  And then just use the message queue to send the location to the next tool so that it downloads the file itself using Nginx.
[45:49.610 --> 45:52.790]  Because Nginx is built better for serving files.
[45:53.410 --> 45:56.810]  ZeroMQ built better for serving, you know, small text strings.
[45:58.570 --> 46:02.190]  I prefer to keep all of my output in Elasticsearch.
[46:03.130 --> 46:08.950]  Cuckoo, right now, needs to be Cuckoo modified to have an output plugin for Elasticsearch.
[46:09.250 --> 46:16.970]  I'm personally working on developing an Elasticsearch plugin for the main, you know, Cuckoo.
[46:18.350 --> 46:20.710]  Thug uses Elasticsearch natively.
[46:20.710 --> 46:29.310]  Bro has an option to export logs in JSON format, which can be easily consumed by Elasticsearch, as does volatility.
[46:30.010 --> 46:35.430]  I prefer to glue everything together with Python 3, because I hate Python 2.
[46:35.650 --> 46:37.450]  It needs to die and go away.
[46:37.890 --> 46:41.830]  Mainly because of text processing and the idiocy of...
[46:41.830 --> 46:44.890]  It was just a historical mistake.
[46:45.030 --> 46:47.230]  They didn't know how to do it right yet.
[46:47.550 --> 46:49.370]  But it needs to die and go away.
[46:51.590 --> 46:57.750]  So, by the way, we're getting towards the question component.
[46:58.010 --> 47:03.490]  But I wanted to say, like, there's more fun that we can have with malware analysis.
[47:03.490 --> 47:10.450]  And the week after next, I'm giving this talk as a four-hour workshop at DEF CON.
[47:10.850 --> 47:13.330]  And so, each of these tools will have...
[47:13.330 --> 47:19.370]  Basically, you can, you know, sleep through the teaching part, because you've seen it.
[47:19.510 --> 47:25.750]  But the 45 minutes of hands-on training for each one of these tools, I'll be giving in DEF CON.
[47:26.650 --> 47:29.970]  And then, please, that evening...
[47:29.970 --> 47:32.870]  So, I'm giving it Thursday, the first day of DEF CON.
[47:33.110 --> 47:36.270]  Please come to our party and get drunk with me that day.
[47:37.450 --> 47:38.350]  At 6 p.m.
[47:38.370 --> 47:39.050]  to 9 p.m.
[47:39.190 --> 47:45.570]  I know if you go visit this URL, it says Black Hat Party, and you have to come to our Black Hat booth.
[47:45.870 --> 47:47.510]  Not completely true.
[47:48.050 --> 47:49.210]  Come find me.
[47:49.210 --> 47:50.210]  I'll give you an invite.
[47:51.050 --> 47:55.730]  Also, I'm going to be in Serbia, talking about another completely...
[47:55.730 --> 47:59.810]  different concept that I have called predictive CVE hunting.
[48:00.610 --> 48:02.650]  And I'll be presenting that at BallCon.
[48:02.910 --> 48:09.190]  And then, I will be wrapping up everything about the open source malware lab at Virus Bulletin in Denver.
[48:11.830 --> 48:13.110]  So, questions.
[48:19.450 --> 48:21.050]  Three minutes for questions.
[48:25.800 --> 48:28.040]  I can't even see you because...
[48:28.040 --> 48:28.660]  Oh, there we go.
[48:31.680 --> 48:32.320]  Yes.
[48:32.820 --> 48:37.340]  So, how did you, like, really get into malware analysis in the beginning?
[48:37.500 --> 48:39.040]  Like, how did you get good at all of this stuff?
[48:39.100 --> 48:40.120]  Because it's really complicated.
[48:41.300 --> 48:44.500]  So, I mean, there's many long stories.
[48:44.700 --> 48:51.880]  I encourage you to come to Blarney Rock with me and continue to, you know, imbibe tonight.
[48:51.880 --> 48:53.280]  I'll give you the full story.
[48:53.500 --> 48:56.200]  But, it involves being a landscaper.
[48:57.440 --> 49:00.540]  And then, after being...
[49:00.540 --> 49:02.480]  I'm actually not joking, by the way.
[49:02.620 --> 49:04.140]  So, it involves being a landscaper.
[49:04.420 --> 49:13.080]  And then, having someone on my landscaping team talk to me and say, you know, what the fuck are you doing as a landscaper?
[49:13.080 --> 49:17.020]  You should come send your resume to the place where...
[49:17.020 --> 49:18.920]  He was moonlighting as a landscaper.
[49:19.040 --> 49:19.640]  I was not.
[49:20.540 --> 49:20.700]  But, yeah.
[49:21.000 --> 49:21.960]  So, you know.
[49:23.320 --> 49:29.680]  And then, I worked in a SOC and did malware analysis and phishing analysis.
[49:29.980 --> 49:30.980]  And now, I'm here.
[49:30.980 --> 49:31.680]  So...
[49:35.460 --> 49:45.400]  If you could elaborate a little bit more, something as a privacy conscious person who kind of likes to roll my own stuff but doesn't always have the time.
[49:46.380 --> 49:56.580]  The passive DNS stuff you were talking about, that's something that I just see, like, highly useful to figure out what apps and services are doing behind your back.
[49:57.420 --> 49:59.460]  So, is there a recommend...
[49:59.460 --> 50:02.640]  Every time I think of configuring bind, I...
[50:02.640 --> 50:03.780]  I don't know.
[50:03.860 --> 50:04.840]  Go and do something else.
[50:05.100 --> 50:14.920]  Is there, like, a sort of, like, one-stop shop for configuring a reasonable DNS server that will give you nice logs of everything that's hitting it?
[50:15.580 --> 50:15.900]  Yes.
[50:16.280 --> 50:16.520]  Okay.
[50:16.540 --> 50:20.100]  So, the answer to your question is much longer.
[50:20.400 --> 50:20.640]  Okay.
[50:20.640 --> 50:22.520]  But, I can say, go to...
[50:23.060 --> 50:23.660]  Excuse me.
[50:23.780 --> 50:27.340]  Go to ISC website and look up PDNS.
[50:27.580 --> 50:27.820]  Okay.
[50:28.120 --> 50:31.360]  There are ways that you can configure it to do what you want.
[50:31.600 --> 50:31.880]  Okay.
[50:32.120 --> 50:32.280]  Thanks.
[50:33.540 --> 50:37.260]  And, actually, if I can plug some, you know, good friends of mine.
[50:38.060 --> 50:53.220]  Circle, which is one of the certs in Luxembourg, provides, as long as you are one of the good people and you can prove to them that you are, like, a malware analysis person or a security person, they'll give you access to their PDNS system.
[50:53.420 --> 50:53.780]  Okay.
[50:56.600 --> 51:00.460]  Obviously, this malware, as part of your analysis, you let it punch out.
[51:01.120 --> 51:05.620]  I'm curious, do you completely sandbox isolate that network?
[51:05.860 --> 51:06.340]  Like, literally?
[51:06.840 --> 51:07.160]  No.
[51:07.860 --> 51:08.840]  Well, yes.
[51:09.040 --> 51:10.340]  It is completely isolated.
[51:10.560 --> 51:12.640]  It's actually living on a...
[51:12.640 --> 51:23.700]  So, by the way, when you do malware analysis, it's very rare to find a hosting company that does not use the word malware or virus in their terms of service.
[51:24.240 --> 51:30.620]  So, I will not tell you where I am hosting my stuff, but I am not violating their terms of service.
[51:30.840 --> 51:35.160]  But I am isolating it from my network, you know, completely.
[51:36.100 --> 51:39.900]  And, just on that note, like, are we talking, like, you're VLAN-ing it?
[51:39.900 --> 51:42.660]  Or we're talking, like, literally hardware isolated?
[51:43.040 --> 51:43.320]  No, it's...
[51:43.320 --> 51:47.180]  It is sitting on a dedicated server in X location.
[51:47.300 --> 51:51.800]  And it has all of this software that we just talked about running on it.
[51:52.060 --> 51:56.340]  And there is interfaces via API and UI.
[51:56.820 --> 51:57.280]  And that's it.
[51:57.460 --> 51:59.020]  Like, it then goes out.
[51:59.180 --> 51:59.820]  I do.
[51:59.980 --> 52:00.940]  I am a good citizen.
[52:00.940 --> 52:04.500]  So, I block port 25 and all the other submission, you know.
[52:04.740 --> 52:09.840]  So, it's not just, you know, spamming stuff from what I'm doing, so.
[52:10.560 --> 52:12.740]  And then, do you do...
[52:13.380 --> 52:20.060]  And if you do, how do you maybe set it up where you're going to have, like, a networked environment?
[52:20.240 --> 52:23.700]  Because a lot of times malware will reach out to your nearest neighbor.
[52:24.140 --> 52:27.700]  And so, how do you model that, like, in your setup?
[52:28.620 --> 52:31.700]  So, there is no LAN situation involved.
[52:32.800 --> 52:34.140]  So, it's basically raw internet.
[52:34.660 --> 52:44.140]  And so, you know, there's no difference between it reaching out to his neighbor in my sandbox and reaching out to his neighbor just, you know, out there in the raw internet.
[52:44.440 --> 52:47.260]  So, you know, it's not in a local area network.
[52:47.980 --> 52:51.180]  And, you know, obviously, we're doing malware analysis.
[52:51.240 --> 52:57.680]  So, it's up to the other entities on the internet to protect themselves from the things that it means.
[52:57.680 --> 52:58.520]  I can't admit from my box.
[52:58.640 --> 52:59.300]  I'm sorry.
[52:59.460 --> 53:01.760]  I need to do the malware analysis work.
[53:02.360 --> 53:02.840]  But...
[53:02.840 --> 53:03.800]  So, you don't...
[53:03.800 --> 53:04.360]  Sorry.
[53:04.500 --> 53:06.420]  You don't do any sort of virtual LAN, right?
[53:06.640 --> 53:07.880]  So, there are...
[53:07.880 --> 53:16.480]  I actually have a configuration for Cuckoo that allows me to use what's called inetsim and, you know, fake DNS.
[53:16.920 --> 53:18.260]  And so, I can run things.
[53:18.400 --> 53:21.260]  And these are actually really important when you're doing malware analysis.
[53:21.260 --> 53:22.540]  Because sometimes...
[53:22.540 --> 53:23.720]  A lot of the time...
[53:24.520 --> 53:28.720]  I will look at a piece of malware and the C2 has been taken down by the ISP.
[53:28.880 --> 53:30.260]  But I still want to know what's happening.
[53:30.480 --> 53:33.600]  So, I want to have that C2 pretend to respond to the malware.
[53:33.800 --> 53:37.600]  So, I'll have it reach out via a different network.
[53:38.160 --> 53:43.880]  You know, that's completely closed and have inetsim and fake DNS running.
[53:45.860 --> 53:46.420]  All right.
[53:46.700 --> 53:47.320]  I'm done.
[53:50.490 --> 53:51.370]  All right.
[53:51.430 --> 53:53.690]  By the way, I don't want to interrupt the next speaker.
[53:53.690 --> 53:57.030]  But I have a ton of T-shirts.
[53:57.030 --> 54:00.330]  And I'll just hang out back there and throw them into...
[54:00.330 --> 54:01.410]  Give them to whoever wants them.