EKTotal: Integrated tool to analyze Drive-by Download attack

BlackHat USA 2018 Arsenal

https://github.com/nao-sec/ektotal
https://www.blackhat.com/us-18/arsenal/schedule/index.html#ektotal-11949

Transcript

1. https://78.media.tumblr.com/tumblr_lr2fpeEE7i1r2wqsxo1_r1_1280.jpg
   1
   

   View Slide

2. View Slide

3. https://blog.trendmicro.com/trendlabs-security-intelligence/a-look-into-recent-exploit-kit-activities
   3
   

   View Slide

4. View Slide

5. View Slide

6. View Slide

7. View Slide

8. F
   I
   L
   T
   E
   R
   1
   F
   I
   L
   T
   E
   R
   2
   RIG Exploit Kit
   Analyzer
   W
   E
   B
   U
   I
   GrandSoft Exploit Kit
   Analyzer
   Magnitude Exploit Kit
   Analyzer
   Bloodlust Drive-by
   Analyzer
   @EKFiddle 8
   

   View Slide

9. Deploy -just 4 step-
   9
   

   View Slide

10. Conclusion
    - Just submit pcap or saz file
    - It detects and analyzes traffic of various
    attack campaigns and Exploit Kits
    - You can know the vulnerabilities
    that may have been exploited, and extract malware
    10
    

    View Slide

11. View Slide