MWS 2020

Copyright©2020 nao_sec All Rights Reserved.

Introduction

Copyright©2020 nao_sec All Rights Reserved.

DbD Threat Landscape2019-07azera

2018-07

2019-03

Underminer

Spelevo

2019-08

Lord

2018-082019-07

Fallout

Radio[1] https://blog.malwarebytes.com/threat-analysis/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit/[2] https://nao-sec.org/2018/09/hello-fallout-exploit-kit.html[3] https://twitter.com/kafeine/status/1103649040800145409[4] https://twitter.com/jeromesegura/status/1148289957716344832[5] https://nao-sec.org/2019/07/weak-dbd-attack-with-radioek.html[6] https://twitter.com/adrian__luca/status/1156934215566536705

Copyright©2020 nao_sec All Rights Reserved.

Our Research

Copyright©2020 nao_sec All Rights Reserved.

Motivation of Development ”Augma“• A drive-by threat is still “ACTIVE”• Many attack campaigns and EKs have appeared• Manual drive-by observation is too hard
• We want to research the latest threat trends
automatically• Active Observation + Analysis + Extraction

Copyright©2020 nao_sec All Rights Reserved.

Challenges of Exploit Kit Crawling• Anti-Cloaking• EK and malware distribution infrastructure BAN specific IP address
and range• Example, TrendMicro, Symantec and public cloud IP range is BANNED byRIG EK• Behaving:• Evading checks of Ad-networks• Chasing:• Crawling target selection is difficult• Accuracy:• Need reliable detection rules

Copyright©2020 nao_sec All Rights Reserved.

Augma:An automated active observation platform

Copyright©2020 nao_sec All Rights Reserved.

Augma Overview
SlackChannel

The InternetIntraGathering App
nao_sec/tknk_scanner etcsummarize,gathering and more
8

Traffic Analyzer

Exit IP Anonymizer

nao_sec/EKTotal

activedefense/PRIVATE

Task Runner&DB

Active Honeypot

activedefense/PRIVATE

nao_sec/StarC
windows7 crawler to ad-network

Copyright©2020 nao_sec All Rights Reserved.

Active Honeypot (StarC)• Simple high-interactive client honeypot• https://github.com/nao-sec/starc• Input a URL, StarC access and collect data
• Traffic data (pcap & saz)
• Screenshot• Temp directory files

Copyright©2020 nao_sec All Rights Reserved.

Traffic Analyzer (EKTotal)• Automatic DbD traffic analyzer• https://github.com/nao-sec/ektotal• Input a pcap or saz, EKTotal analyze traffic data
• Identify campaign & EK
• Extract some information• Encode key• CVE Number• SWF file
• Malware• Detecting with EKFiddle’s rules and Augma custom rules• https://github.com/malwareinfosec/EKFiddle• Lazy “Gate Estimation” added on July, 2019
Copyright©2020 nao_sec All Rights Reserved.

Lazy “Gate Estimation”• Gate• We call ”Gate” that campaign specific redirect server• EKTotal can estimate Gate• This function helps identify and categorize campaigns• Some campaigns NOT go through Gate

Copyright©2020 nao_sec All Rights Reserved.

Finally...

RIG EKUnderminer EK
FALLOUT EK

12Copyright©2020 nao_sec All Rights Reserved.

Augma 2020 Dataset
Overview

Copyright©2020 nao_sec All Rights Reserved.

Augma 2020 Dataset• Period: 2019/05-2020/04• Data:• Captured malicious traffic as Fiddler saz format and pcapng format.

• Files and Directories:• augma2020/augma2020dataset.description.en.txt• augma2020/augma2020dataset.description.ja.txt• augma2020/ek/ek.metadata.tsv• augma2020/ek/samples/{*.pcap and * .saz}• augma2020/tss/tss.metadata.tsv• augma2020/tss/samples/{*.pcap and * .saz}• augma2020/unidentifiedek/samples/

Copyright©2020 nao_sec All Rights Reserved.

Statistics(Unit: file)

All threats potentially target to Japan(Augma uses JP related IP Addresses)

pcap: 10020
- ek:
7418
- tss:
2544- unidentifiedek: 58
saz: 10008
- ek:
7419
- tss:
2544- unidentifiedek: 45
Copyright©2020 nao_sec All Rights Reserved.

Our Dataset Covered almost EKs in the wild
Underminer EK Fallout EK GrandSoft EK RIG EK Spelevo EK Capesand EK Radio EK Lord EK Bottle EKTotal
May-19Jun-19Jul-19Aug-19Sep-19Oct-19
Nov-19Dec-19Jan-20Feb-20Mar-20
Apr-20

5176
449
682
456
0
16
263
601
812
1040
255
510
92

583
0
30
113189
182
25
32
20
51
39
1520
17
13
1057
39
40
94
121
118
1100

443
72
49
10101
4292
2727
32
720

103
0808609000000

590000001742000035000035000000019000
1900000000

9000000000
540

Custom EK(azera) KaiXin

4004000000000

1100000000000

⽉次総計

6952
539
782
491
266
321
503
739
1034
1205
354
625
93

Copyright©2020 nao_sec All Rights Reserved.

Example (metadata)
TSV(Tab Separated Values):
1 line per 1 crawl
date:2019/05/01 00:10:02
saz:ek/samples/2019-05-01_00-10-02.saz
pcap:ek/samples/2019-05-01_00-10-02.pcapname:Underminer EK
mal_url:http://27.122.57.192:9081/index.php?ad_id={snipped}
name:Underminer EK
mal_url:http://27.122.57.192:9081/js/bhfsbqqpvs9nr61tnqqou0lr8g.js• Identifier derives from EKFiddle’s rule and Augma custom rule
• Some rules define another identifier on same EK detection likeGrandSoft(Checker) and GrandSoft(Landing)

Copyright©2020 nao_sec All Rights Reserved.

Attention• You SHOULD refer to published article[7] when you
publish anything with this dataset• You MUST pay attention to use IP, URL and payloads
in this dataset. It is potentially malicious[7] Rintaro Koike and Yosuke Chubachi, "Finding drive-by rookies using an
automated active observation platform", VirusBulletin 2019, Oct. 2019.
Copyright©2020 nao_sec All Rights Reserved.

Any Questions?
Twitter: @nao_sec
Email:
info@nao-sec.org
Copyright©2020 nao_sec All Rights Reserved.