powerpoint presentation - recon€¢cryptohunt • • findcrypt2-with-mmx • findcrypt • •...
TRANSCRIPT
………….
………….
VirtualAlloc
………….
………….
VirtualAlloc
………….
………….
………….
VirtualAlloc
XOR
RWX
© 2017 F5 Networks
RW
………….
………….
VirtualAlloc
………….
………….
VirtualAlloc
………….
………….
………….
VirtualAlloc
XOR
RWX
© 2017 F5 Networks
RW
RW………….
………….
VirtualAlloc
………….
………….
VirtualAlloc
………….
………….
………….
VirtualAlloc
XOR
RWX
© 2017 F5 Networks
RW
RW
Hash: 1c43d2aa92..
Hash: 3c6a240d6..
………….
………….
VirtualAlloc
………….
………….
VirtualAlloc
………….
………….
………….
VirtualAlloc
XOR
RWX
© 2017 F5 Networks
RW
RW………….
………….
VirtualAlloc
………….
………….
VirtualAlloc
………….
………….
………….
VirtualAlloc
XOR
RWX
Hash: 1c43d2aa92..
Hash: 3c6a240d6..
Hash: 1c43d2aa92..
Hash: 2c5023a24..
© 2017 F5 Networks
RW
PLAINTEXT ?………….
………….
VirtualAlloc
………….
………….
VirtualAlloc
………….
………….
………….
VirtualAlloc
XOR
RWX
Hash: 1c43d2aa92..
Hash: 3c6a240d6..
Hash: 1c43d2aa92..
Hash: 2c5023a24..
© 2017 F5 Networks
RW
CONFIG !………….
………….
VirtualAlloc
………….
………….
VirtualAlloc
………….
………….
………….
VirtualAlloc
XOR
RWX
© 2017 F5 Networks
0x400000
packer
0x3c0000
payload
0x600000
final
payload
Unpacking
Allocation
Allocation
Allocation
Malware
Allocations
………….
………….
VirtualAlloc
………….
………….
VirtualAlloc
………….
………….
………….
VirtualAlloc
XOR
RWX
RWX
© 2017 F5 Networks
………….
………….
VirtualAlloc
………….
………….
VirtualAlloc
………….
………….
………….
VirtualAlloc
XOR
© 2017 F5 Networks
RWX
RWX
RW
………….
………….
VirtualAlloc
………….
………….
VirtualAlloc
………….
………….
………….
VirtualAlloc
XOR
© 2017 F5 Networks
RWX
RWX
RW
RW………….
………….
VirtualAlloc
………….
………….
VirtualAlloc
………….
………….
………….
VirtualAlloc
XOR
© 2017 F5 Networks
RWX
RWX
RW
RW
Hash: 1c43d2aa92..
Hash: 3c6a240d6..
………….
………….
VirtualAlloc
………….
………….
VirtualAlloc
………….
………….
………….
VirtualAlloc
XOR
© 2017 F5 Networks
RWX
RWX
RW
RW………….
………….
VirtualAlloc
………….
………….
VirtualAlloc
………….
………….
………….
VirtualAlloc
XOR
Hash: 1c43d2aa92..
Hash: 3c6a240d6..
Hash: 1c43d2aa92..
Hash: 2c5023a24..
© 2017 F5 Networks
RWX
RWX
RW
CONFIG………….
………….
VirtualAlloc
………….
………….
VirtualAlloc
………….
………….
………….
VirtualAlloc
XOR
© 2017 F5 Networks
RWX
RWX
• CryptoHunt
• https://code.google.com/p/kerckhoffs/
• findcrypt2-with-mmx
• FindCrypt
• http://www.recon.cx/2012/schedule/events/208.en.html
• Finding and Extracting Crypto Routines from Malware