tech_scareware_presentation.pdf

Transcript

1. ANATOMY OF A MASSIVE MALWARE DISTRIBUTION CAMPAIGN A brief taxonomy of SLOR Tools, Techniques & Procedures
2. INTRODUCTION Emily Crose Network Threat Hunter Ironnet Cybersecurity Twitter: @hexadecim8
3. SLOR …But also a malware distribution campaign
4. IT STARTS WITH A THREAD…
5. THE FOUR W’S What the fuck is this shit? Where the fuck is this shit coming from? Who the fuck is doing this shit? Why the fuck is it doing this shit?
6. WARNING There will be swears in this presentation
7. Network active ping port scan URL Fuzzing Banner Grabbing passive whois Centralops.net Domain tools Reputation checks virustotal registration pivoting RiskIQ PassiveDNS File Forensics file reputation file hash Sandbox analysis Hybrid-analysis
10. WHO TF IS DOING THIS? Cloudflare Range
13. EW . NO. W HAT THE F IS THIS??
15. HYBRID ANALYSIS
16. Links
22. What The
     Is This SHIT?!
23. • Auto-generated domains • A TON more domains with similar looking documents to the original we found • The domains look like they’re being created and cached every day. • Same registration service • All whoisguarded • Documents which apparently aren’t malicious
24. THIS DOC HAS TO BE MALICIOUS RIGHT!?!
25. My research IP address
28. WAT DO?
29. FAST FLUX CAMPAIGN • Domains change rapidly • Malware is delivered, delivery endpoints dissolve into the aether • Fairly good OPSEC to this campaign
30. CAMPAIGN EVOLUTION DGA Reasonable-ish 2nd level domain DGA evasion
32. ANYTHING IN THE C2??
33. EXTRA_TARGET_0.BAT
34. WHAT CAN WE DO? • Domain blocking? • It’ll all be gone tomorrow • IP blocking • They change too frequently • Application whitelisting? • Sure, but what if it something changes again?
35. LESSONS LEARNED • ABC – Always Be Curious • Trust your instincts • Be a good citizen • You may not always get the answers that you’re looking for, and that’s okay
36. MORAL OF THE STORY • “You can’t always get what you want.” -Mick Jagger
37. CONTACT INFO • Emily Crose • Ironnet Cybersecurity • Twitter: @Hexadecim8 • Email: Emily.Crose@ironnetcybersecurity.com