The Rule for Wild Mal-Gopher Families.
NTT Security Japan
Kazuya Nomura
Sachito Hirao

Agenda1. Introduction
2. Creating YARA Module

3. Clustering Evaluation
4. Applying to "Wild" Binaries
5. Conclusions
Appendix© 2023 NTT Security Holdings All Rights Reserved

1. Introduction
The Rule for Wild Mal-Gopher Families.

© 2023 NTT Security Holdings All Rights ReservedAbout Us
Kazuya Nomura
SOC analyst at NTT Security Japan. His main work is alert monitoring with IPS/IDS/EDR. He
has contributed articles on malware analysis and data visualization in NTT Security Japan.
He is a recipient of the MWS2020 paper award and an outstanding alumnus of
SecHack2020.
Sachito Hirao
SOC analyst at NTT Security Japan. Formerly an infrastructure engineer in thefinancial sector.
At SOC, he was in charge of NW/EDR alert monitoring as well as malware analysis.
© 2023 NTT Security Holdings All Rights ReservedGolang Malware• Golang malware family grows year after year•

Complexity of analysis due to characteristic structure•

Buildable for multiple platforms

Advantages for the attacker• The number of diverse samples will continue to increase•

Increased efficiency of classification•

Increased efficiency of analysis by attributing to previously analyzed samples

Improved efficiency of Golang malware classification and analysis© 2023 NTT Security Holdings All Rights ReservedGolang Malware• Various malware creation frameworks exist for Golang•

Coldfire

•

CHAOS

•

EGESPLOIT•ARCANUS• Many frameworks inactive development
https://github.com/redcode-labs/Coldfire© 2023 NTT Security Holdings All Rights Reserved

https://github.com/tiagorlampert/CHAOS

gimphash• Golang binary version’s imphash•

Golang binaries have a platform-independent structure called pclntab•

Dependent package names, function names, etc. can be restored•

gimphash is a partial SHA256 hash of the recovered package/function name•

Uniquely capable of representing the functionality on which malware depends, but similarity comparisonsof different hashes are not possible

github.com/example/ExampleFunction

gimphashgithub.com/example/Malicious

e3b0c44298...

os.Getenv
Crypto/sha256/New...

pclntab© 2023 NTT Security Holdings All Rights Reserved

sha256

gimpfuzzy• gimphash to fuzzy hash•

SHA256 output varies greatly if input differs by even 1 bit•

Fuzzy Hash computes a "rough" hash that returns similar values for similar inputs•

gimpfuzzy uses ssdeep. Similarity between samples can be measured.

gimpFuzzypclntabgithub.com/example/ExampleFunction

3:j4dwGIVWYvgxN4dwGIV3M
NWzYKKKvTKrs:j4mGggximG
CMcTjKrs

github.com/example/Maliciousos.Getenv
Crypto/sha256/New...
github.com/example/AnotherFunction
github.com/example/Maliciousos.Getenv
Crypto/sha256/New...
© 2023 NTT Security Holdings All Rights Reserved

Allows comparisonof similarities

3:j4dwGIV++RSXzM9xN4dwGIV3M
NWzYKKKvTKrs:j4mGduSXg9xim
GCMcTjKrs

Motivation & Goals
1. YARA module implementation•

Enables fast and easy classification of large sample groups

2. Accuracy evaluation using analyzed samples•

Consider optimal parameters for family classification

3. Applied to samples submitted to VirusTotal•

Application to unanalyzed “wild” samples•

Discussion of the latest Golang malware applications© 2023 NTT Security Holdings All Rights ReservedDifference Between Previous Presentation• CODE BLUE 2022
“Who is the Mal-Gopher? - Implementation and Evaluation of “gimpfuzzy” for Go
Malware Classification”•

First to propose a method for applying Fuzzy Hash to gimphash•

Analyzed samples are classified by gimphash and evaluated the accuracy.

• JSAC2023 “The Rule for Wild Mal-Gopher Families.”
Implementation and evaluation with a focus on application in actual operations and analysis•

Creation of a YARA module that allows classification of samples for implementation.

•

Application and evaluation of “wild” unanalyzed samples submitted to VT© 2023 NTT Security Holdings All Rights ReservedCreating YARA Module
The Rule for Wild Mal-Gopher Families.

© 2023 NTT Security Holdings All Rights Reserved

YARA• Toolkit for malware classification being developed by VT[1]•By writing classification rules, only samples that satisfy the rules can be searched•High speed because it is implemented with C• Various modules exist depending on the file structure• The following modules do not exist•

Module for handling Golang binaries•

Module for Fuzzy Hashing and string similarity calculation• To make it easier to classify samples by gimpfuzzy,
YARA module was newly impremented[1] https://github.com/VirusTotal/yara© 2023 NTT Security Holdings All Rights Reserved

12Creating YARA Module
Implement the following two• go module : analyzes PE binaries made by golang•

go.gimpfuzzy() : gimpfuzzy calculate from extracted function name•go.function_names : sort strings of extracted function names• fuzzy module : calculate similarity of Fuzzy Hash•

fuzzy.fuzzy() : fuzzy hash calculation from argument string•

fuzzy.score() :computes score based on the edit distance between two argument strings© 2023 NTT Security Holdings All Rights Reserved

13

Writing YARA Rule
• Example of YARA rules•

Enables searches based on similarity of samples based on gimpfuzzy

import "go"import "fuzzy"
import "pe"rule GoFuzzyTest{
CONDITIONS:
pe.is_pe andfuzzy.score(go.gimpfuzzy(), "96:O5iaa8UdGAq27F92...")> 80}
Similarity
Score
Calculation© 2023 NTT Security Holdings All Rights Reserved

gimpfuzzycalculation
results forsamplesCompareFuzzy Hash

The similarity is over 80.
Search for samples
14

Using YARA Module• Enables sample search based on gimpfuzzy similarity

root@1f06b9d1f716:/malwares# yara /test.yara -r .
GoFuzzyTest . /Valhalla_hktl_htran_golang/4550635143c9997d5499d1d4a4c860126ee9299311fed0f85df9bb304dca81ff
GoFuzzyTest . /Valhalla_hktl_htran_golang/645622a85906da6304315ae9444046f2310609da933f53e87b54fbb206b53e3e
GoFuzzyTest . /Valhalla_hktl_htran_golang/4e5468e36dc7bc5601384f22c032f990f2e8454d27f6b11e8e897fb0c6c5e0e5
GoFuzzyTest . /Valhalla_hktl_htran_golang/65cfa86dec6f19cdbf5f9641ab835af023d34fa23b0e31a9f9b66c93a221d7a2
GoFuzzyTest . /Valhalla_hktl_htran_golang/72549bdc9e857162603f3ce90f1bfc8eb761e7e9f399a24a2bba47468b6edfe3
GoFuzzyTest . /Valhalla_hktl_htran_golang/91bce99e792db5c3da42da3f01f50a1021f9538b78f70544bedc9ca7508ce54e
GoFuzzyTest . /Valhalla_hktl_htran_golang/d45a6f12d5956f0fb8ad17727c717b621e3be06fabf9ff27058cb86f8f108b7d
GoFuzzyTest . /Valhalla_hktl_htran_golang/e70e0c8fb2727b35b65596a6e2838abd0b5f7351cdd4031b9971b91c22f5d15c© 2023 NTT Security Holdings All Rights Reserved

15

Developing YARA Module• Implement the following functions
function (e.g.
math,programming,
programing)
Main
imple
ment
ation

module_initialize

Initialization process for YARA module

module_finalize

YARA module termination processmodule_load

Processing when the module reads a file
Implement the actual parsing logic for the filemodule_unload

Post-processing when the module reads a file
Delete hash tables, open structures, etc.

© 2023 NTT Security Holdings All Rights Reserved

16Developing YARA Module• It is important that each function returns a corresponding error when an
exception occurs.
•

In some cases,
the YARA side will post-process appropriately.
#ifndef
ERROR_SUCCESS
success#define ERROR_SUCCESS 0
process#endifing#define ERROR_INSUFFICIENT_MEMORY 1#define ERROR_COULD_NOT_ATTACH_TO_PROCESS 2#define ERROR_COULD_NOT_OPEN_FILE 3#define ERROR_COULD_NOT_MAP_FILE 4#define ERROR_INVALID_FILE 6#define ERROR_CORRUPT_FILE 7© 2023 NTT Security Holdings All Rights Reserved

error
handling

17

Demonstration : YARA Module
Demonstration© 2023 NTT Security Holdings All Rights ReservedClustering Evaluation
The Rule for Wild Mal-Gopher Families.

© 2023 NTT Security Holdings All Rights ReservedClustering Evaluation• Clustering evaluation using actual observed “wild” samples

Evaluation using unanalyzed, up-todate samples

Evaluation using analyzed samples•

Classify samples identified as malware only•

Evaluate the validity and accuracy of clustering© 2023 NTT Security Holdings All Rights Reserved•

Includes samples not identified as malware•

Evaluate use in actual operations

20

Overview of Clustering Methods• gimpfuzzy similarity-based clustering
1.

Calculate gimpfuzzy of samples for clustering

2.

Calculate gimpfuzzy similarity between samples for clustering

3.

Edge-connect samples with similarity above a threshold

4.

Connected samples are considered as a cluster.
50

A

30

80

Cluster 3f

10

B
Cluster 1

E

20

60
60

70

C

10

When samples with threshold≥ 70 are connectedD

100

Cluster 2© 2023 NTT Security Holdings All Rights Reserved

21

Scoring Matrix• Calculate scores for all combinations of samples•

Scoring of string similarity from 0~100 based on edit distance•

Create an “adjacency matrix” and consider an undirected graph
Color corresponds to family

A

B

C

D

E

f

A

0

80

0

0

30

50

B

80

0

0

10

20

0

C

0

0

0

100

60

60

D

0

10

100

0

70

10

50

A

f

30

80

10

B

20

E

60
60

70

C

10

E
f

30
50

20
00

60
60

70
10

© 2023 NTT Security Holdings All Rights Reserved

0
0

0
0

D

100
22

How to Evaluate Clustering• How to cut the threshold: what constitutes good clustering?
•

Low threshold case: a small number of large clusters are formed•

High threshold case: a large number of small clusters are formed
50

Af
Cluster 2

30

80

20

E

D

Cluster 1

C
100

Cluster 1

Threshold ≥ 30
◎Many samples can be tied together (integrity ↑)Decrease in classification accuracy within a △ cluster(homogeneity ↓)© 2023 NTT Security Holdings All Rights Reserved

10

B

60

f

30

60

70

10

Cluster 5

80

10

B

50

A

E

20 Cluster 3

60
60

70

C

10

D

100

Cluster 4

Threshold ≥ 90
◎ High classification accuracy within clusters (homogeneity ↑)△ Clusters are too separated to be meaningful (integrity ↓)23

How to Evaluate Clustering• Harmonic mean is considered in trade-off between the two• Using V-measure[2] implemented in scikit-learn for evaluation•

Homogeneity Score ℎ: The higher the percentage of a single correct answer group in a given cluster, the score is better•

Integrity score 𝑐 : The fewer cluster into which a given group of correct answers is classified, the score is betterℎ⋅𝑐𝑉𝛽 = 1 + 𝛽 ⋅ℎ+𝑐[2] https://www.researchgate.net/publication/221012656_V-Measure_A_Conditional_Entropy-Based_External_Cluster_Evaluation_Measure© 2023 NTT Security Holdings All Rights Reserved

24Evaluation••

What is the correct classification in the first place?
•

Minor variants and version differences
in malware families•

malware family•

Rough malware features

Evaluation by paloalto dataset [3]•Analyzed samples with families
classified by YARA•

Exclude samples that did not have a family name•Evaluate the classified results and family namewith V-measuresampleMatches.

SHA256

YARA rules[3]https://github.com/pan-unit42/iocs/blob/master/golang_malware_results.csv© 2023 NTT Security Holdings All Rights Reserved25Evaluation• paloalto data set•

Number of samples: 10,700•

Number of samples downloadable from VT: 7,088•

Of which, family name is indicated : 5,808• Evaluation by V-measure•

Evaluation of classification assuming thatthe family is correct•

Best classification accuracy ata threshold of about 70~80© 2023 NTT Security Holdings All Rights Reserved26

Advantages of Our Methods•

Advantages of gimpfuzzy’s similarity-based clustering compared to machine learning•

Low calculational complexity•

Less susceptible to time variation

When new samples are added
Fuzzy Hashcalculation

Obtaining
Samples

Calculate featuresindicating newly
emerged package
namesClassification by gimpfuzzy
Past calculation results are reusable, easy to scale
Previous Samples andSimilarity calculation
Classification
Complete
Re-train the classifier
with a new classifier

Reclassify all
samples with the newclassifier

Machine Learning Classification
Possibly perform huge calculations for all samples every time a new sample is added© 2023 NTT Security Holdings All Rights Reserved

27

Applying to “Wild” Binaries
The Rule for Wild Mal-Gopher Families.

© 2023 NTT Security Holdings All Rights Reserved

Applying to "Wild" Binaries• Clustering evaluation using actual observed "wild" samples

Evaluation using unanalyzed, up-todate samples

Evaluation using analyzed samples•

Classify only samples identified as malware•

Evaluate the validity and accuracy of clustering© 2023 NTT Security Holdings All Rights Reserved•

Includes samples not identified as malware•

Evaluate use in actual operations

29Collecting Wild Binaries• Download the samples that matched the following YARA with VT’s Retrohunt•

Samples that matched Windows binaries made by golang
rule go_language_pe{
strings:$go1 = "go.buildid" ascii wide$go2 = "go.buildi¥" ascii wide$go3 = "Go build ID:" ascii wide$go4 = "Go buildinf:"$go5 = "runtime.cgo"$go6 = "runtime.go"$go7 = "GOMAXPRO"$str1 = "kernel32.dll" nocase
CONDITIONS:
uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and 2 of ($go*) and all of ($str*)}© 2023 NTT Security Holdings All Rights Reserved30Collecting Wild Binaries• Sample collection results
RetroHunt

9999 samples

Download from VT• Samples collected by Retrohunt(Approximately the last 3 months from 2022/12)• Downloaded samples without duplicatessuch as Subfile9016 samples
In case of insufficient bytes of ssdeep input

Can be improved by using TLSH, etc.

gimpfuzzy calculation

2876 samples© 2023 NTT Security Holdings All Rights Reserved••

Samples for which pclntab analysis + gimpfuzzy
calculation was possible
UPX are unpacked and analyzed
31

Clustering Result• Created 1093 clusters for 2867 samples© 2023 NTT Security Holdings All Rights ReservedClustering Result• Cluster Visualization•

Implemented with Python’s bokeh.io•

Create interactive “moveable” graphs•

Red node have 10 or more malignant
determinations by VT© 2023 NTT Security Holdings All Rights Reserved

Demonstration : Cluster Visualization
Demonstration© 2023 NTT Security Holdings All Rights Reserved

Case Study 1 / GitHub Packages• Golang can specify github repository for packages• Focused on samples with more than 10 malignant determinations,705 repository names recovered.
•

Including repositories that are considered private.

• Interesting repository name restored•

Packages that generate random UAs (corpix/uarand etc.)•

Packages that conduct Process Invoking (inconshreveable/mousetrap, etc.)•

Malware creation frameworks (tiagorlampert/CHAOS, etc.)•

Multi-hop proxies (Dliv3/Venom, etc.)•

Post-Exploitation framework (Ne0nd0g/merlin, etc.)© 2023 NTT Security Holdings All Rights Reserved35

Case Study 1 / GitHub Packages
Top 20 github repositories that appeared in malignant samples© 2023 NTT Security Holdings All Rights Reserved

Case Study 2 : Detecting Additional
Malware Features• Detect small changes in GimpFuzzy values in clusters of malignant samples
and observe temporal changes•

768:KZZ99PdnRrLXT3UbhHPBj/RqJgvm+HHHyScP0OhZlXCPlNvxtWrX7G/VAmWeEX•

768:KZZ99PdnRrLXT3UbhHPBj/RqJgvm+HHHyScP0OhZlXCPlNvxtWrX7G/V3mWeEX

25
20
15
10
5
0

© 2023 NTT Security Holdings All Rights Reserved37

Case Study 2: Detecting malware
functionality additions• Changed functions also changed logic.
•

Function name that was changed•

768:~VAmWeEX→ application/pesignaturetest/wincert.GetPostalCode•768:~V3mWeEX→ application/pesignaturetest/wincert.Extract

wincert.GetPostarCode© 2023 NTT Security Holdings All Rights Reserved

wincert.Extract38

Case Study 2: Detecting malware
functionality additions• Some functions with unchanged function names have logic changes•

main_reportInstllFailure is added to the communication functionality.

© 2023 NTT Security Holdings All Rights Reserved

39Case Study ③ : Legitimate Files• In reality, legitimate files dominate.
•

Same for samples submitted to VT.

•

Is clustering of regular files possible?

many

Samplesfew
few

Malignancy determination© 2023 NTT Security Holdings All Rights Reserved

many

40

Case Study ③ : Legitimate Files• Even samples that appear to be legitimate files can cluster.
•

samples submitted to VT are not necessarily only malignant files© 2023 NTT Security Holdings All Rights Reserved

41

Case Study ④ : Floxif• Mixed clusters of malignant /benign determinations•

Even though gimpfuzzy is similar,
malignancy judgments vary widely
within clusters

58/71© 2023 NTT Security Holdings All Rights Reserved42Case Study ④ : Floxif• Highly malicious samples lurking in legitimate file clusters•

We found a highly malignant Floxif sample that mimicked the following program•

psiphone-tunnel-core•

Acronis Cyber Protect•

It is difficult to determine malignancy/benignity in some samples with unsupervised clustering alone•

Correct results as sample profiling© 2023 NTT Security Holdings All Rights Reserved

43

Limitations• Existence of samples for which gimpfuzzy cannot be calculated•

Lower limit of ssdeep input size exists (>4KB). It can be replaced by TLSH, etc.

•

Analysis is interfered by packing, obfuscation, etc.

• Limitations of “unsupervised” classification•

It is difficult to determine malignant / benign.

•

Separated by clusters to some extent, but some clusters with malignant and benign samples still
exist.

© 2023 NTT Security Holdings All Rights Reserved

44

Conclusions
The Rule for Wild Mal-Gopher Families.

© 2023 NTT Security Holdings All Rights Reserved

Conclusions• Presented on the following topics to apply gimpfuzzy to actual operations•

YARA module implementation•

Accuracy evaluation using analyzed samples•

Application to samples submitted to VirusTotal• YARA module and visualization scripts are to be released.

© 2023 NTT Security Holdings All Rights Reserved

46Appendix
The Rule for Wild Mal-Gopher Families.

© 2023 NTT Security Holdings All Rights Reserved

Appendix 1• Number of malignancy determinations for samples collected in VT•

Overwhelmingly less malignant files

Analyzed samples
analyzed : 2835
© 2023 NTT Security Holdings All Rights Reserved

Unanalyzed samples :9999 samples
48Appendix 2• Edit Distance (Levenshtein Distance)•

Classic method of showing string similarity•

Minimum number of times one string can be converted to the other by inserting, deleting, or
replacing a single character.

Security
Securit.

edit
distance3(1) Delete y(2) Delete u

Secrit(3) Replace i→e© 2023 NTT Security Holdings All Rights Reserved

secret49

Appendix 3• ssdeep (Context Triggered Piecewise Hashing)•

Piecewise Hashing : Hash of divided part of the data•

Rolling Hash : Hash for fixed-length partial data

input data

Piecewise Hashinga b c d e f g h i j k l
Rolling Hash•

When the Rolling Hash reaches a certain value, it is split there and Piecewise Hashing is performed.
•

The triggering value is calculated based on the input data length

input dataa b c d e f g h i j k l

The similarity of the inputs
can be reflect well

© 2022 NTT Security Holdings All Rights Reserved50