## 5 Study Cases
### Red October Analysis
#### 5.1.1 Malware Classification  
* Transfer. The malware is transferred via encrypted USB and decompressed: \(\odot\) red_oct.document.exploit-(exploit) \(\odot\) red_oct.bin.drop-(dropper)
* Identification (see Table 7). Obtaining the HASH MD5 signature of the files that theoretically contain the malware:  
* Check for malware (see Table 8). Tested using online tools (virus total) and installable application Avira. Considering that Red October was detected in 2012, the results obtained from the verification phase confirm that we are analyzing a piece of malware. \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Victim** & **Monitor and Windows Services** & **Services** \\ \hline WinMD5 & PEViewer & Md5 sum & Netcat \\ Md5 sum & Process Monitor & WinMD5 & HTTP Apache \\ Strings & RegShot & Strings & Aplicacion FTP \\ BinText. & PeStudio & PEiD & Fake DNS \\ Avira & VMMap & Dependency Walker & Inetsim \\ Process Explorer & Systracer & PEBrowse & AVG \\ PEiD & DiskPulse & Olydbg & F-prot \\ Dependency Walker & GMER & PE Explorer & Binwalk \\ Ollydbg & Winpmem & Wireshark & Volatility \\ PE Explorer & Wireshark & & Foremost \\ IDA Pro & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Tools used in the analysis \begin{table}
\begin{tabular}{c c c} \hline \hline
**File Name** & **File Size** & **MD5** \\ \hline red\_oct.document.exploit & 547 KB & bb2f6240402f765a9d0d0e550b79 cd2560 \\ red\_oct.bin.drop & 521 KB & 598 ce670b5e4 be42966 dbfae18188792 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Malware Identification \begin{table}
\begin{tabular}{c c} \hline \hline
**Entity** & **Detection** \\ \hline Avast & XLS:CVE-2009-3129 [Expl] \\ Kaspersky & Trojan-Dropper.MSWord.Agent.ga \\ TrendMicro & TROJ\_OLEXP.B \\ Fortinet & MSExcel/CVE\_2009\_3129.Alexploit \\ McAfee-GW-Edition & Heuristic.BehavesLike.Exploit\_X97.CodeExec.O \\ Microsoft & Exploit:Win32/CVE-2009-3129 \\ Ad-Aware & Exploit:CVE-2009-3129.Gen \\ BitDefender & Exploit:CVE-2009-3129.Gen \\ McAfee & Exploit:MSExcel.ac \\ AVG & Dropper.Generic\_c.NZR \\ Symantec & Backdoor.Rocra \\ ClamAV & NO \\ Panda & NO \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Antivirus detection * Open Source (OSINT). Derived from the previous steps, we are able to conduct an open source search very effectively. During this part of the analysis, high relevance information is obtained for the following phases of the methodology. The most important ones are listed below. * Identification of the level of complexity of the malware in analysis. It is confirmed that it is an APT, which allows us to prepare and be aware that it is a highly complex malware. * Identification of the vulnerabilities used by APT to infect victims. In particular, five potential attack vectors are identified:
* CVE-2009-3129: XLS files (MS Excel)
* CVE-2010-3333 DOC files (MS Word)
* CVE-2012-0158 DOC files (MS Word)
* CVE-2011-3544 Java-related vulnerability
* CVE-2008-4250 Vulnerability to infect other computers on the network
* It is confirmed that the malware does not make use of any 0-Day vulnerability, thus taking advantage of systems not patched correctly or not updated. * Key files used in the infection process are identified:
* %ProgramFiles%WINDOWS NTLHAFD.GCP (This name may vary)
* %ProgramFiles%WINDOWS NTSVCHOST.EXE
* The code of a critical file 'MSC.BAT' is identified. It is also verified that a command is executed to change the reference character table for coding which means that can be a correlation with the use of Cyrillic characters in its origin. * MSC.BAT file has the following contents:
* chcp 1251
* attrib -a -s -h -r \"%DROPPER_FILE%\" of \"%DROPPER_FILE%\" if exist \"%DROPPER_FILE%\" goto Repeat of \"%TEMP%msc.bat\"
* It is identified that the malware does not interact if it is not able to establish an outside connection, in particular with the command and control (C & C).