Teasing theSecrets fromThreat Actors
Malware Conﬁguration Extractors

Mark Lim
● Senior Malware
Researcherat Palo Alto Networks● Based in Singapore● Love to go for long jogs

OUTLINE● Background● Evolutionary journey of Guloader
conﬁguration techniques○ Ciphertext Splitting○ Control Flow Obfuscation● Summary

BackgroundWhat are malware conﬁgurations?
● Similar to ‘settings’ or ‘preferences’in software● Malware conﬁguration deﬁnes theuniqueness of each instance● C&C addresses, encryption keys,
attack parameters and other IOCs
● Tough to obtain statically● But can be extracted from process
memory.

Malware Conﬁguration Extraction Workﬂow

Memory Analysis andMalware
Conﬁguration ParsingSandbox
Snapshot
Data
Malware Analysts
Create Malware
Conﬁg Extractors

Malware ConﬁgsindexedWhat and Why Guloader ?
●
●
●
●
●

Also known as CloudEye
Windows Malware downloader
Shellcode based
Constantly evolving
Utilised many anti-analysis techniques

Evolutionary Journey Of Guloader’s Conﬁguration
Tactics

Evolutionary Journey Of Guloader’s Conﬁguration
Tactics

Hiding in plain sightSearch for the string“http” would reveal
C2 urlCiphertext Splitting???

Ciphertext has to be decoded inblocks from a function before it canbe used????

2022
2020
C2 url are
encrypted and nolonger starts with“http”

Q4
2022

Q12023Control ﬂow obfuscation
Control ﬂow obfuscation progressively applied
to increase the complexity of retrieving theciphertext

Q4
2023

Evolutionary Journey Of Guloader’s Conﬁguration
Tactics

Hiding in plain sightSearch for the string“http” would reveal
C2 urlCiphertext Splitting???

Ciphertext has to be decoded inblocks from a function before it canbe used????

2022
2020
C2 url areencrypted and nolonger starts with“http”

Q4
2022

Q1
2023

Control ﬂow obfuscation
Control ﬂow obfuscation progressively applied
to increase the complexity of retrieving theciphertext

Q4
2023

Decrypting Malware Conﬁguration

Encryption
routineEncryption
key

Ciphertext

Decrypting Malware Conﬁguration

SimpleXOR

Predictable location ofencryption key???

Ciphertext Splitting

1.

Ciphertext splitted into multiple
DWORD

2.

Each DWORD is encoded withdifferent arithmetic operations

3.

Stored as local variables in functions

A1CD2379F530FA9458A71CE2EED42D1BA3C125D9

A1CD2379

F530FA9458A71CE2

EED42D1B

A3C125D9{+-&*&}{^-^*}{+-*&}{&-^&}{^&^*}BC24D7A1

DE14CFD3

78CD13EF

34DABC34

EF3A32FD

Ciphertext SplittingFirst DWORD is the length of the ciphertext!

Control Flow Obfuscation

Control Flow Obfuscation

0xCC bytes triggering
EXCEPTION_BREAKPOINT

Instructions triggering
EXCEPTION_ACCESS_VIOLATION

Control Flow Obfuscation

Find and patch them all!

Control Flow Obfuscation

Sample 1 2023 Q2

Sample 1 2023 Q2
1. 0xCC bytes triggering
EXCEPTION_BREAKPOINT
2. instructions triggering
EXCEPTION_SINGLE_STEP
3. Instructions triggering
EXCEPTION_ACCESS_VIOLATION

Instructions triggering single step exception!

Sample 1 2023 Q2Does not work anymore!

Diving into implementation of control ﬂow obfuscation

Diving into implementation of control ﬂow obfuscation

0xCC bytes triggering
EXCEPTION_BREAKPOINT

Diving into implementation of control ﬂow obfuscation

0xCC bytes triggering
EXCEPTION_BREAKPOINT

Diving into implementation of control ﬂow obfuscation

0xCC bytes triggering
EXCEPTION_BREAKPOINT

Diving into implementation of control ﬂow obfuscation

0xCC bytes triggering
EXCEPTION_BREAKPOINT

Diving into implementation of control ﬂow obfuscation

0xCC bytes triggering
EXCEPTION_BREAKPOINT

Diving into implementation of control ﬂow obfuscation●●

Instructions triggering
EXCEPTION_SINGLE_STEP
Instructions triggering
EXCEPTION_ACCESS_VIOLATION

Diving into implementation of control ﬂow obfuscation●Hiding the single byte key

Evolutionary Journey Of Guloader’s Conﬁguration
Tactics
Sample 1 2023 Q2
1.

Ciphertext splitting

2.

0xCC bytes triggering
EXCEPTION_BREAKPOINT

3.

Instructions triggering
EXCEPTION_ACCESS_VIOLATION

4.

Instructions triggering
EXCEPTION_SINGLE_STEP

Evolutionary Journey Of Guloader’s Conﬁguration
Tactics
Sample 1 2023 Q2

Evolutionary Journey Of Guloader’s Conﬁguration
Tactics
The Solution!

Sample 1 2023 Q2

1.

Using memory dumps from sandbox
execution2.

Locate function containing splitted
cipher text using yara

3.

Locate the single byte key used in the
exception handler via yara

4.

Using Unicorn CPU emulator framework

5.

Emulate the function containing theDWORD

6.

Handle the 3 types of exceptions

Evolutionary Journey Of Guloader’s Conﬁguration
Tactics

Hiding in plain sightSearch for the string“http” would reveal
C2 urlCiphertext Splitting???

Ciphertext has to be decoded inblocks from a function before it canbe used????

2022
2020
C2 url no longer
starts with “http”

Q4
2022

Q1
2023

Control ﬂow
obfuscation
progressively applied to increase thecomplexity of retrieving the ciphertext

Q3
2023

Evolutionary Journey Of Guloader’s Conﬁguration
Tactics
The challenger!
Sample 2 Q3 2023
1. Ciphertext splitting
2.

0xCC (INT 3) instructions

3.

Null pointer access violation instructions

4.

CPU trap ﬂag instructions

Evolutionary Journey Of Guloader’s Conﬁguration
Tactics
Sample 2 Q3 2023
1.

Ciphertext splitting

2.

0xCC bytes triggering
EXCEPTION_BREAKPOINT

3.

Instructions triggering
EXCEPTION_ACCESS_VIOLATION

4.

Instructions triggering
EXCEPTION_SINGLE_STEP

5.

….?

Evolutionary Journey Of Guloader’s Conﬁguration
Tactics
Sample 2 Q3 2023
●TWO additional exceptions added!

Evolutionary Journey Of Guloader’s Conﬁguration
Tactics
Sample 2 Q3 2023
1.

Ciphertext splitting

2.

0xCC bytes triggering EXCEPTION_BREAKPOINT

3.

Instructions triggering
EXCEPTION_ACCESS_VIOLATION

4.

Instructions triggering EXCEPTION_SINGLE_STEP

5.

Instructions triggering
EXCEPTION_ILLEGAL_INSTRUCTION

6.

Instructions triggering
EXCEPTION_PRIV_INSTRCTION

Evolutionary Journey Of Guloader’s Conﬁguration
Tactics
The Solution!

Sample 2 Q3 2023

1.

Using memory dumps from sandbox
execution2.

Locate function containing splitted
cipher text using yara

3.

Locate the single byte key used in the
exception handler via yara

4.

Using Unicorn CPU emulator framework

5.

Emulate the function containing theDWORD

6.

Handle the 3 types of exceptions

Evolutionary Journey Of Guloader’s Conﬁguration
Tactics
The challenger!
1.

Ciphertext splitting

2.

0xCC (INT 3) instructions

3.

Null pointer access violation instructions

4.

CPU trap ﬂag instructions

Evolutionary Journey Of Guloader’s Conﬁguration
Tactics
Sample 2 Q3 2023
1.

Important offset values are hidden

2.

Encoded using arithmetic operations

3.

Existing yara rules wont work

Evolutionary Journey Of Guloader’s Conﬁguration
Tactics
The Solution!

Sample 2 Q3 2023

1.

Using memory dumps from sandbox
execution2.

Locate function containing splitted
cipher text using yara

3.

Locate the single byte key used in theexception handler via yara

4.

Using Unicorn CPU emulator framework

5.

Emulate the function containing theDWORD

6.

Handle the 3 types of exceptions

Summary● Malware authors continues to evolve theirtechniques to hide conﬁgurations!

● Combining yara, emulation and scripting toautomate malware conﬁgurations extractions

More interesting details in our paper!

Thank you