45

Malware's Most Wanted: The Many Faces of Malware

  • Upload
    cyphort

  • View
    132

  • Download
    3

Tags:

Embed Size (px)

Citation preview

Page 1: Malware's Most Wanted: The Many Faces of Malware
Page 2: Malware's Most Wanted: The Many Faces of Malware

The Many Faces of Malware

@belogor

Page 3: Malware's Most Wanted: The Many Faces of Malware

Your speakers today

Nick Bilogorskiy@belogor

Director of Security Research

Shel SharmaProduct Marketing Director

Page 4: Malware's Most Wanted: The Many Faces of Malware

Agenda

o Fake Antiviruso Ransomwareo APTso Adwareo Web Exploitso Wrap-up and Q&A

Cyph

ort L

abs

T-sh

irt

Page 5: Malware's Most Wanted: The Many Faces of Malware

Threat Monitoring & Research team

________

24X7 monitoring for malware events

________

Assist customers with their Forensics and Incident Response

We enhance malware detection accuracy

________

False positives/negatives

________

Deep-dive research

We work with the security ecosystem

________

Contribute to and learn from malware KB

________

Best of 3rd Party threat data

Page 6: Malware's Most Wanted: The Many Faces of Malware

FAKE ANTIVIRUS

Page 7: Malware's Most Wanted: The Many Faces of Malware

Fake Antivirus timeline

Mac Defender

Antivirus XP 2008

2005 2008 2009 2010 2011 2012 2013 2014

WinFixerPC Optimizer Pro

Page 8: Malware's Most Wanted: The Many Faces of Malware

WinFixer

Page 9: Malware's Most Wanted: The Many Faces of Malware

XP Antivirus 2008

Affiliate Username Account Balance (USD)

nenastniy $158,568.86krab $105,955.76rstwm $95,021.16newforis $93,260.64slyers $85,220.22ultra $82,174.54cosma2k $78,824.88dp322 $75,631.26iamthevip $61,552.63dp32 $58,160.20

Page 10: Malware's Most Wanted: The Many Faces of Malware

2011 - Mac Defender

Page 11: Malware's Most Wanted: The Many Faces of Malware

2011 - Mac Defender

o Pavel Vrublevsky Sentenced to 2.5 Years

Page 12: Malware's Most Wanted: The Many Faces of Malware

2015 Adware PcOptimizerPro

o PcOptimizerPro shows fake alerts of performance problems

o Fixing only possible with commercial version

o Offers user to buy an upgrade

Page 13: Malware's Most Wanted: The Many Faces of Malware

PC Optimizer Pro

Page 14: Malware's Most Wanted: The Many Faces of Malware

RANSOMWARE

Page 15: Malware's Most Wanted: The Many Faces of Malware

PGPCoder Trojan – 1024 RSA key, collects money via EGOLD

Bitcoin was invented by Satoshi Nakamoto

Reveton Trojan, aka Police Trojan. collects money via Moneypak

BitCoin becomes popular, Cryptolocker appears

Cryptowall, TeslaCrypt

Ransomware History

2005

2009

2012

2013

2014

Page 16: Malware's Most Wanted: The Many Faces of Malware

TeslaCrypt

Page 17: Malware's Most Wanted: The Many Faces of Malware

TeslaCrypt

Page 18: Malware's Most Wanted: The Many Faces of Malware

TeslaCrypt

Page 19: Malware's Most Wanted: The Many Faces of Malware

Kovter Kovter

Page 20: Malware's Most Wanted: The Many Faces of Malware

CryptoWall

Page 21: Malware's Most Wanted: The Many Faces of Malware

CryptoWall 3.0 example

Page 22: Malware's Most Wanted: The Many Faces of Malware

Lockers

Page 23: Malware's Most Wanted: The Many Faces of Malware

Koobface solves CAPTCHAs

Page 24: Malware's Most Wanted: The Many Faces of Malware

ADVANCEDPERSISTENTTHREAT

Page 25: Malware's Most Wanted: The Many Faces of Malware

DarkSeoul

o DarkSeoul, a hacking group with suspected links to North Korea, performed a delayed wipe on 32,000 systems at South Korean banks and media companies

o Credit claimed by Whois

Page 26: Malware's Most Wanted: The Many Faces of Malware

Sony Wiper

Page 27: Malware's Most Wanted: The Many Faces of Malware

DarkComet RAT

Page 28: Malware's Most Wanted: The Many Faces of Malware

BlackShades RAT Trojan

Page 29: Malware's Most Wanted: The Many Faces of Malware

BlackShades RAT Trojan

Page 30: Malware's Most Wanted: The Many Faces of Malware

BlackEnergy/Sandworm

o CVE-2014-4114 o “complete list

of Members of Parliament”.

Page 31: Malware's Most Wanted: The Many Faces of Malware

Asprox/Kuluoz

Page 32: Malware's Most Wanted: The Many Faces of Malware

ADWARE

Page 33: Malware's Most Wanted: The Many Faces of Malware

Groovorio Spyware

Page 34: Malware's Most Wanted: The Many Faces of Malware

SafeSear.ch Adware

Page 35: Malware's Most Wanted: The Many Faces of Malware

Browser Hijacker BrowseIgnite

Page 36: Malware's Most Wanted: The Many Faces of Malware

OSX – Genieo

o MD5: 11f085fdfca46a4b446760a0e68dc2c3o Browser Hijacker

Page 37: Malware's Most Wanted: The Many Faces of Malware

Outbrowse

Page 38: Malware's Most Wanted: The Many Faces of Malware

Hack Tools

Page 39: Malware's Most Wanted: The Many Faces of Malware

Hack Tools

Page 40: Malware's Most Wanted: The Many Faces of Malware

EXPLOITS

Page 41: Malware's Most Wanted: The Many Faces of Malware

Web Exploits running

Page 42: Malware's Most Wanted: The Many Faces of Malware

Web Exploits running

Page 43: Malware's Most Wanted: The Many Faces of Malware

Summaryo Most malware runs silentlyo Some malware uses GUI for monetizationo Error windows are very common in malware

output, both real and fakeo APTs display fake documents for misdirection

Page 44: Malware's Most Wanted: The Many Faces of Malware

Thank You!Twitter: @belogor

Previous MMW slides on

http://cyphort.com/labs/malwares-wanted/

Page 45: Malware's Most Wanted: The Many Faces of Malware

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Documents
Metamorphic Malware 1 Metamorphic Malware Research

Metamorphic Malware 1 Metamorphic Malware Research

Documents
Reversing malware analysis trainingpart9 advanced malware analysis

Reversing malware analysis trainingpart9 advanced malware analysis

Technology
Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Documents
Reversing malware analysis training part8 malware memory forensics

Reversing malware analysis training part8 malware memory forensics

Technology
Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Documents
THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

Documents
Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Documents
Malware's Most Wanted: Financial Trojans

Malware's Most Wanted: Financial Trojans

Technology
Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Documents
Malware's Most Wanted (MMW): Backoff POS Malware

Malware's Most Wanted (MMW): Backoff POS Malware

Technology
Evasive Techniques: An IntroductionAT]minerva-labs.com 5 The Sum of All (Malware) Fears Classifying Malware's Phobias In order to better understand the usage of evasive techniques

Evasive Techniques: An IntroductionAT]minerva-labs.com 5 The Sum of All (Malware) Fears Classifying Malware's Phobias In order to better understand the usage of evasive techniques

Documents
Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Documents
The many faces of Gh0st Rat - Norman Safegrounddownload01.norman.no/documents/ThemanyfacesofGh0stRat.pdf · The many faces of Gh0st Rat. Plotting the connections between malware attacks

The many faces of Gh0st Rat - Norman Safegrounddownload01.norman.no/documents/ThemanyfacesofGh0stRat.pdf · The many faces of Gh0st Rat. Plotting the connections between malware attacks

Documents
Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Documents
Windows Malware Firewall: Remove Windows Malware Firewall

Windows Malware Firewall: Remove Windows Malware Firewall

Technology
Malware's Most Wanted: Linux and Internet of Things Malware

Malware's Most Wanted: Linux and Internet of Things Malware

Technology
Malware's Most Wanted: How to tell BADware from adware

Malware's Most Wanted: How to tell BADware from adware

Technology
Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Documents
Intrusion Detection and Malware Analysis - Malware collection

Intrusion Detection and Malware Analysis - Malware collection

Documents
Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Documents
MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Documents
Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Documents
Evaluating Open Source Malware Sandboxes with Linux malware

Evaluating Open Source Malware Sandboxes with Linux malware

Documents
Malware, Malware y más Malware ¿Cómo me puedo proteger? “Dijo el cliente web”

Malware, Malware y más Malware ¿Cómo me puedo proteger? “Dijo el cliente web”

Documents
Analisis dan Deteksi Malware Menggunakan Metode Malware

Analisis dan Deteksi Malware Menggunakan Metode Malware

Documents
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL

Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL

Technology
Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Documents
1 Automated malware audit service Automatischer Malware Audit

1 Automated malware audit service Automatischer Malware Audit

Documents
Evasive Techniques: An Introduction - Amazon S3 · research[AT]minerva-labs.com 5 The Sum of All (Malware) Fears Classifying Malware's Phobias In order to better understand the usage

Evasive Techniques: An Introduction - Amazon S3 · research[AT]minerva-labs.com 5 The Sum of All (Malware) Fears Classifying Malware's Phobias In order to better understand the usage

Documents