Crypton - exposing malware's deepest secrets

Presented at VB2017, Oct. 4, 2017, 4:30 p.m. (30 minutes).

A significant part of the malware research process is dedicated to reversing cryptographic algorithms in order to extract the decrypted content. Revealing this content provides access to the heart of the malware: all the strings, *Windows* API calls, DGA algorithms, communication protocols, and when focusing on financial malware, the list of targeted institutions and webinjects. Malware authors know that we're after this data, which is why they put considerable effort into constantly changing their encryption routines and designing customized implementation algorithms. Even the smallest change requires significant work on the part of the malware researcher: reversing has to be applied to reconstruct the encryption scheme. Over the years, numerous plug-ins and tools have been developed to solve this problem. Some have been highly academic endeavours that relied on complicated algorithms to identify cryptography, but which were not adapted for real-world usage; others relied on signature checks to locate specific algorithms. We wanted to find a lightweight and practical implementation that would effectively speed up the research process. That's why we developed an automated approach, based on a heuristic way of detecting such cryptographic algorithms regardless of the type of algorithm used, that extracts their plain text output. The implementation of this approach saves a lot of valuable research time. Our implementation, "Crypton", works by unpacking the malware, then following injected code and memory allocations in order to identify blocks of cryptographic code, and inspecting the allocations for decrypted data. Our tool will follow all the processes created and injected by the malware as the decryption may happen in any one of them - therefore we must follow any execution flow. We plan to give some insights into our work with the latest financial malware, their internals and their usage of cryptographic algorithms, compression routines and pseudo random generators. We will describe the idea and the architecture of the Crypton tool and present a demo with live malware and our complementary IDA-python script that identifies all crypto blocks inside a memory dump.

Presenters:

• Julia Karpin - F5 Networks
  Julia Karpin Julia Karpin has been a financial malware researcher for most of the current decade. Having started as a malware reverser at Trusteer (now an IBM company), Julia is currently a senior malware researcher at F5 Networks. Julia graduated from Israel's institute of technology (Technion) in 2012, during her studies she worked as a security analyst at Check Point Software Technologies. @s0lid_dr4g0n
• Anna Dorfman - F5 Networks
  Anna Dorfman Anna Dorfman is a malware reverser who's also a cryptography enthusiast. She is currently a malware researcher at F5 Networks. Anna graduated with a B.Sc. in computer science from the University of Bar-Ilan at 2013. Her previous roles include software engineering at Versafe (now F5 Networks). @___IgniS

Links:

• https://www.virusbulletin.com/conference/vb2017/abstracts/crypton-exposing-malwares-deepest-secrets
• https://www.virusbulletin.com/uploads/pdf/conference_slides/2017/Karpin-VB2017-Crypton-deepest-secrets.pdf
• https://www.virusbulletin.com/virusbulletin/2017/10/vb2017-paper-crypton-exposing-malwares-deepest-secrets/

Similar Presentations:

• REcon 2017 / Crypton - Exposing malware's deepest secrets
• Black Hat USA 2014 / Prevalent Characteristics in Modern Malware
• DerbyCon 3.0 All in the Family (2013) / The Malware Management Framework, a process you can use to find advanced malware. We found WinNTI with it!