MWS 2021

Copyright©2021 nao_sec All Rights Reserved.

Introduction

Copyright©2021 nao_sec All Rights Reserved.

Malvertising – Drive by Download
Advertising

Redirection

GateExploit Kit

MalwareUser
3

Copyright©2021 nao_sec All Rights Reserved.

Exploit Kit still sharpens a sword

4

Copyright©2021 nao_sec All Rights Reserved.

Motivation of Development ”Augma“• A drive-by threat is still “ACTIVE”• Many attack campaigns and EKs have appeared• Manual drive-by observation is too hard
• We want to research the latest threat trends
automatically• Active Observation + Analysis + Extraction

Copyright©2021 nao_sec All Rights Reserved.

Challenges of Exploit Kit Crawling• Anti-Cloaking• EK and malware distribution infrastructure BAN specific IP addressand range• Example, TrendMicro, Symantec and public cloud IP range is BANNED byRIG EK• Behaving:• Evading checks of Ad-networks• Chasing:• Crawling target selection is difficult• Accuracy:• Need reliable detection rules

Copyright©2021 nao_sec All Rights Reserved.

Augma Overview
SlackChannel

The InternetIntraGathering App
nao_sec/tknk_scanner etc

summarize,
gathering and more
7

Traffic Analyzer

Exit IP Anonymizer

nao_sec/EKTotal

activedefense/PRIVATE

Task Runner&DB

Active Honeypot

activedefense/PRIVATE

nao_sec/StarC
windows7 crawler to ad-network

Copyright©2021 nao_sec All Rights Reserved.

Active Honeypot (StarC)• Simple high-interactive client honeypot• https://github.com/nao-sec/starc• Input a URL, StarC access and collect data
• Traffic data (pcap & saz)
• Screenshot• Temp directory files

Copyright©2021 nao_sec All Rights Reserved.

Traffic Analyzer (EKTotal)• Automatic DbD traffic analyzer• https://github.com/nao-sec/ektotal• Input a pcap or saz, EKTotal analyze traffic data
• Identify campaign & EK
• Extract some information• Encode key• CVE Number• SWF file
• Malware• Detecting with EKFiddle’s rules and Augma custom rules• https://github.com/malwareinfosec/EKFiddle• Lazy “Gate Estimation” added on July, 2019
Copyright©2021 nao_sec All Rights Reserved.

Lazy “Gate Estimation”• Gate• We call ”Gate” that campaign specific redirect server• EKTotal can estimate Gate
• This function helps identify and categorize campaigns• Some campaigns NOT go through Gate

Copyright©2021 nao_sec All Rights Reserved.

Augma 2021 Dataset Overview

Copyright©2021 nao_sec All Rights Reserved.

Augma 2021 Dataset• Period: 2020/05-2021/04• Data:• Captured malicious traffic as Fiddler saz format and pcapng format.
• ek including exploit kit traffic• tss including tech support scam traffic• Files and Directories:• augma2021/augma2021dataset.description.en.txt• augma2021/augma2021dataset.description.ja.txt• augma2021/ek/ek.metadata.tsv• augma2021/ek/samples/{*.pcap and * .saz}• augma2021/tss/tss.metadata.tsv• augma2021/tss/samples/{*.pcap and * .saz}

Copyright©2021 nao_sec All Rights Reserved.

Statistics – System
Period: 2020-05-01 00:05:01+00:00-2021-04-30 23:55:01+00:00
Total patrol: 95333, hit: 15342, total engage rate: 0.161

13

Copyright©2021 nao_sec All Rights Reserved.

Statistics – dataset files
All threats potentially target to Japan(Augma uses JP related IP Addresses)(Unit: file)pcap: 10667- ek:- tss:
saz: 10008- ek:- tss:cf). Augma Dataset 2020

10667
4682
10667
4682

pcap: 10020- ek:- tss:
saz: 10008- ek:- tss:

7418
2544
7419
2544

Copyright©2021 nao_sec All Rights Reserved.

Summarydate

15

BottleEK

total

May-20804

Jun-20Jul-20TSS(audio)

PurpleFox
PseudoGate (EK
RIG EK
EKRedirection)

0663

1484

01417

56

Aug-201368

Sep-20Spelevo
EK

Underminer Capesand
EKEK

Fallout
EKTSS (evilcursor)

TSS (Browlockgen)

Fallout CVE-2018EK
8174

011500000222111028

0165

101089544007001153

182476030

56

400001234

133

010000000002089

1725

338

20

2000000040Oct-20

4011

3599

390

000000220000

Nov-20

2187

2098

55

340000000000

Dec-20136095

311900000000Jan-21

584

0224

360

0000000000Feb-21

483

0312

15001920000000Mar-21

1800

154

00026

0000000

Apr-21282

596

10014733000000

Copyright©2021 nao_sec All Rights Reserved.

Example (metadata)
TSV(Tab Separated Values):
1 line per 1 crawl
date:2019/05/01 00:10:02
saz:ek/samples/2019-05-01_00-10-02.saz
pcap:ek/samples/2019-05-01_00-10-02.pcap
name:Underminer EK
mal_url:http://27.122.57.192:9081/index.php?ad_id={snipped}
name:Underminer EK
mal_url:http://27.122.57.192:9081/js/bhfsbqqpvs9nr61tnqqou0lr8g.js• Identifier derives from EKFiddle’s rule and Augma custom rule
• Some rules define another identifier on same EK detection likeGrandSoft(Checker) and GrandSoft(Landing)

Copyright©2021 nao_sec All Rights Reserved.

Attention• You SHOULD refer to published article[7] when you
publish anything with this dataset• You MUST pay attention to use IP, URL and payloads
in this dataset. It is potentially malicious[7] Rintaro Koike and Yosuke Chubachi, "Finding drive-by rookies using anautomated active observation platform", VirusBulletin 2019, Oct. 2019.
Copyright©2021 nao_sec All Rights Reserved.