This work is licensed under a Creative Commons license

Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0)

You are free to:

• Share — copy and redistribute the material in any medium or format.

Under the following terms:

• Attribution — You must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.
• NonCommercial — You may not use the material for commercial purposes.
• NoDerivatives — If you remix, transform, or build upon the material, you may not distribute the modified material.

Introduction To Cybersecurity

Malicious Software

Simone Aonzo, Ph.D.

Reverse Engineering Malware

Simone Aonzo, Ph.D.

☣️ Malicious Software ☣️

Both IntroSec and RevMal courses share this common part… 😅

Then they then diverge:

• IntroSec → Malware Analysis [here]
• RevMal → Part I – SRE Foundations

MALicious softWARE

• Malware is any software which both
• Is unauthorized
• Running without the informed consent of users
• Has intended functionality contrary to the interests of users or the system
• A responsible user fully aware of its intended functionality would not run it
• It is therefore intentionally designed to
• Unknowingly interfere with security and privacy of users and organizations
• What makes malware hard to detect?
• Computational complexity theory is against us: it is an undecidable problem

How does malware get onto computer devices?

• Humans install it unintentionally ⇒ you need to lure them to do it
• Malicious or compromised websites
• Attracting traffic with phishing messages, search engine results, ads, …
• Embedded in “messages”
• E.g., evergreen malicious email attachment
• Misleads users by disguising itself as a standard program (Trojan Horse)
• E.g., supply chain attack
• Humans install it intentionally ⇒ they have motivation 🤑
• E.g., bribe or blackmail insiders, attacker gaining a foothold
• Automatically exploits vulnerable software
• E.g., Conficker worm [2008-2020] MS08-067 – RCE in Server Service

Malware Types (infection mechanism)

• Trojan: benign appearance but hidden malicious features
• Virus: modify other programs to include a copy of itself
• Worm: self-replicate/propagate without user intervention

Malware Types (1/2)

• Adware: displays unwanted or malicious advertising
• Backdoor: persistent foothold
• Bootkit: targets the boot process (e.g., UEFI firmware)
• Bot: communicating with and forming part of a botnet that perform a task given a remote command
• Downloader: download and execute other files
• Dropper: executes an embedded payload (usually another malware)
• Exploit-kit: exploits a software vulnerability

Malware Types (2/2)

• Infostealer: steals and exfiltrates information
• Keylogger: records keystrokes
• Ransomware: encrypts device's data for ransom
• RemoteAccessTrojan (RAT): controls the device through commands issued by a remote attacker
• RootKit: stealth and actively hiding software with elevated permissions
• Spyware: software that invades the user’s privacy
• Wiper: Damage to host machine and its data

Malware Behavior Catalog (MBC)

The MBC is a taxonomy that describes what malware does, enabling consistent behavioral analysis, labeling, and comparison across samples and tools

• Objectives: high-level goals of the malware
• Based on ATT&CK tactics
• E.g.: Persistence and Evasion
• Behaviors: actions that achieve an objective
• Links to ATT&CK techniques
• E.g.: Registry modification and Process Injection
• Micro-behaviors: atomic runtime actions that compose a behavior
• Platform-specific and measurable in dynamic analysis
• E.g.: Add autorun entry
• Methods: concrete ways a behavior is implemented
• Links to ATT&CK sub-techniques
• E.g.: set HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run → exe

​

Short History

Short History (the origins)

• 1981 – First widespread outbreak (on floppy disks) of a replicating program�������

​

Old Hacker School

Short History (the origins)

• 1981 – First widespread outbreak (on floppy disks) of a replicating program�������
• 1981 – Prof. Leonard Adleman (A in RSA) coined the term virus
• 1984 – Fred Cohen publishes “Experiments with Computer Viruses”

​

Old Hacker School

Short History (the origins)

• 1981 – First widespread outbreak (on floppy disks) of a replicating program�������
• 1981 – Prof. Leonard Adleman (A in RSA) coined the term virus
• 1984 – Fred Cohen publishes “Experiments with Computer Viruses”
• 1987 – The Vienna virus is the first one to intentionally destroy data
• – First self-encrypted virus
• – John McAfee found the first antivirus company and � releases Virusscan for MS-Dos

​

Old Hacker School

Short History (the origins)

• 1981 – First widespread outbreak (on floppy disks) of a replicating program�������
• 1981 – Prof. Leonard Adleman (A in RSA) coined the term virus
• 1984 – Fred Cohen publishes “Experiments with Computer Viruses”
• 1987 – The Vienna virus is the first one to intentionally destroy data
• – First self-encrypted virus
• – John McAfee found the first antivirus company and � releases Virusscan for MS-Dos
• 1988 – First Worm: Morris Internet worm

Old Hacker School

Short History (the 90’s)

• 1990 – First demonstration of polymorphic virus
• – Prof. Yisrael Radai coined the term malware
• 1992 – First virus to look for (and damage) an anti-virus
• 1995 – First macro virus infects MS Word documents
• 1998 – Chernobyl destroys the system BIOS. It infected 60M computers
• 1999 – The Melissa macro virus is the first example of large-scale email propagation
• – Back Orifice is the first widespread RAT
• – First Kernel Rootkits Knark (modification of system call table)
• 1999 – Less than 100K unique (per MD5) malware samples

​

Virus Golden Age

Short History (the new millennium)

• 2001 – Code Red (first large-scale, exploit-based worm targets IIS)
• 2001 – The Nimda worm spreads in many ways, including a backdoor left by� Code Red II
• 2003 – SQL Slammer worm (extremely fast propagation)
• – Sobig makes the first attempt to create a spam botnet
• �

​

Worms

Short History (the new millennium)

• 2001 – Code Red (first large-scale, exploit-based worm targets IIS)
• 2001 – The Nimda worm spreads in many ways, including a backdoor left by� Code Red II
• 2003 – SQL Slammer worm (extremely fast propagation)
• – Sobig makes the first attempt to create a spam botnet�
• 2004 – Cabir: first malware for Mobile (Symbian) spreading over Bluetooth
• 2005 – Sony rootkit for DRM protection�

​

Worms

Short History (the new millennium)

• 2001 – Code Red (first large-scale, exploit-based worm targets IIS)
• 2001 – The Nimda worm spreads in many ways, including a backdoor left by� Code Red II
• 2003 – SQL Slammer worm (extremely fast propagation)
• – Sobig makes the first attempt to create a spam botnet�
• 2004 – Cabir: first malware for Mobile (Symbian) spreading over Bluetooth
• 2005 – Sony rootkit for DRM protection�
• 2007 – Storm Worm+Botnet
• – Zeus banking trojan
• 2008 – First Rogue Antivirus
• – Koobface targets Social Networks
• 2009 – Conficker is the first pandemic malware infection

Cyber-Crime

Worms

Short History (2010-15)

• 2010 – Stuxnet targets SCADA systems to sabotage Iranian nuclear� facilities. It was signed with a valid certificate from Realtek
• 2011 – Duqu is discovered by the Crysis lab. Closely related to Stuxnet� (maybe used to prepare stuxnet). It steals information and uploads � them encrypted appended to 54×54 pixel JPEG files
• 2012 – Flame uses a new MD5 collision attack to get a certificate collision
• 2012 – Another state-sponsored malware, Gauss is discovered by Kasperski. � Contains a module (codename Godel) encrypted with a key derived � from a specific configuration on the targeted computer
• 2013 – Leak of the NSA ANT catalog, containing almost 50 surveillance implants
• 2015 – One of the equation group implants can infect the hard drive firmware � of over a dozen different hard drive brands

​

State-Sponsored

Short History (today)

• �Malware in mobile phones is rapidly increasing in number and sophistication��Ransomware as a Service (RaaS) becomes a common business model ��2016 – Mirai is responsible for large DDoS attacks using infected IoT devices
• �2017 – NotPetya is estimated to have caused $10 billion of damage and is � often touted as the most destructive malware of all time�
• 2021 – A Cryptolocker infection at CNA Financial insurance lead to a � $40 million payout�
• 2022 – First malware (cryptominer) designed to execute in an AWS

Diversification

1981 - Virus

1990 - Malware

2000

2010

1981 - Virus

1990 - Malware

2000

AV industry

2010

Worms

2000

1981 - Virus

1990 - Malware

Targeted �State-Sponsored

2010

Cybercrime

Mobile/IoT

Families and Campaigns

Malware family and campaign

Family

• Group of semantically related malicious software programs
• Share similar characteristics, behaviors, and code patterns
• Goal: classification and categorization of similar malware

​

Campaign

• Strategic organized effort to distribute and propagate malware
• It involves targeted or widespread attacks using various techniques and tools
• Goal: broader context of coordinated attacks carried out by threat actors

​

Often the family name coincides with the name of the campaign in which it is used

Malware family and campaign – NotPetya

NotPetya was a high-profile malware family and campaign that occurred in 2017

• Targeted organizations primarily in Ukraine
• Then, quickly spread globally (causing significant disruption)
• Experts believed this was a politically-motivated attack 🇷🇺→🇺🇦
• Masqueraded as Petya (family) ransomware
• In fact, a destructive wiper malware
• Propagated through various techniques
• Phishing emails
• Compromised software updates
• Exploitation of vulnerable system

​

Malware family and campaign – Zeus and Avalanche

• Zeus is a well-known malware family that emerged in 2007
• Banking trojan – numerous variants
• Financial fraud and information theft
• Avalanche campaign
• A massive, global cybercrime operation (more than 180 countries)
• Utilized Zeus and other malware families (e.g., Citadel and GameOver)
• Huge network of servers and infrastructure for distribution
• Money laundering activities
• Stopped in 2016 by an international law enforcement operation

Malware family – Emotet

Emotet is a well-known malware family that emerged in 2014

• The group is the prime example of a successful criminal enterprise
• Started out as a banking malware
• Evolved into a large botnet providing a MaaS
• Referred in the cybersecurity community as MaaS (Malware-as-a-Service)
• Provide access to its infected devices to other threat actors (loader)
• Trickbot, Dridex, IcedID, …
• In 2021, takedown by law enforcements
• The servers used for Emotet were disrupted through global police action

VirusTotal aggregates many antivirus engines

• Users send files and are controlled by all products at the same time
• Anti-virus vendors can receive copies of files that were flagged by other scans

​

Who gives the family names?

Security companies name the families

• CARO naming convention is often not respected
• Different companies can give different names (aliases)
• State of the art: VirusTotal report ➡ AVClass ➡ family

TeslaCrypt

Analysis / Detection / Classification

Analysis

Program Analysis

Program Analysis

Binary�Analysis

Program Analysis

Binary�Analysis

Malware�Analysis

“How to analyze a �program that does not �want to be analyzed”�

Indicators of Compromise (IoCs)

Observable artifacts that indicate a system may have been compromised

• File-based: hashes, file paths, filenames
• Host-based: registry keys, services, mutexes, scheduled tasks
• Network-based: IP addresses, domains, URLs, C2 patterns
• Behavioral: process trees, API call sequences, anomalous actions

Often fragile, i.e., easily changed by attackers

​

Analysis produces IoCs →

classification uses them to make decisions

Classification

“If malware analysis is about extracting data, classification �is about taking decisions �based on that data”�

Detection

“How to detect known or unknown samples, in ~realtime and with�only partial control of the�environment”�

Malware Analysis

Malware Analysis - (My) Definition

“Program analysis of a software that does not want to be analyzed”

​

​

​

​

​

​

​

does not want to be analyzed ⇔ adversarial context

Goals of malware analysis

1. Functional Behavior – what it does
2. Infection & Execution Lifecycle – how it operates in the system
3. Persistence – how it stays active
4. Stealth & Anti-Analysis – how it avoids analysis
5. Command, Control & Infrastructure – how it communicates
6. Detection & Defense – how it can be found and stopped
7. Mitigation & Remediation – how to neutralize it
8. Impact & Risk Assessment – why it matters
9. Attribution & Threat Intelligence – who are the threat actors
10. Analysis Quality & Limitations – how confident we are

Software Reverse Engineering (SRE)

How can you study the code without having the source code?

• Static analysis - Examining the code without execution
• File Structure ↔ hexadecimal editor
• Code ↔ disassembler and/or decompiler
• Binary analysis
• Dynamic analysis - Running it in a controlled environment (AKA Sandbox)
• Operating system interactions
• Network traffic
• Memory dumps
• Hybrid analysis - Combining both static and dynamic analysis

Binary Analysis (BA) ⇆ SRE

• BA answers “what happens at the code level?”
• SRE answers “why it happens and how the system works as a whole”
• BA is the technique (static/dynamic analysis, disassembly, tracing)
• SRE is a broader discipline that uses BA as one of its core methods
• Without BA the SRE lacks evidence
• without SRE binary analysis lacks meaning
• BA focuses on examining compiled code (instructions, CFGs, API calls)
• while SRE aims at reconstructing high-level software’s logic and intent
• BA produces low-level facts and observations
• SRE integrates those facts with context to build models/abstractions/explanations

Classification

[Binary classification] Benign or Malicious?

[Family classification] �If malicious, what other samples behave like it?

Classification

[Binary classification] Benign or Malicious?

[Family classification] �If malicious, what other samples behave like it?

?

Classification

Automated Binary Analysis

[Binary classification] Benign or Malicious?

[Family classification] �If malicious, what other samples behave like it?

Precise� Unbiased

Precise� Unbiased

Scalable

Is it known ??

yes

no

Is it known ??

The vast majority of files are Singleton�Malware use polymorphism to randomize its appearance

yes

no

Is it known ??

yes

no

Does it match a�known signature?

Is it known ??

yes

no

Current static AV signatures are very imprecise.�But this has more to do with Malware detection, and that is another story...

Does it match a�known signature?

Is it known ??

Extract its �behavior

Does it match a�known signature?

yes

no

Is it known ??

Does it match a�known signature?

Is it known ??

Static Analysis

Does it match a�known signature?

Is it known ??

Static Analysis

Malware code is highly obfuscated, encrypted, �self-modifying, dynamically generated, ...

Does it match a�known signature?

Is it known ??

Malware Analysis Sandbox

Does it match a�known signature?

Is it known ??

Malware Analysis Sandbox

Malware is like a Volkswagen: if it knows it is under test, it fakes the results

Does it match a�known signature?

Is it known ??

Malware Analysis Sandbox

Malware is like a Volkswagen: if it knows it is under test, it fakes the results

We can only run programs for �a limited time. Evasion can be as �simple as waiting 5 minutes.

Does it match a�known signature?

What if the malware works only �when the user visits Facebook ?

Is it known ??

Malware Analysis Sandbox

Classifier

Does it match a�known signature?

Is it known ??

Malware Analysis Sandbox

Classifier

Does it match a�known signature?

Lack of a Malware definition, beyond�the “I know when I see it”

No tolerance for False Positives

Adversarial environment�Very noisy data

Is it known ??

good

Malware Analysis Sandbox

Classifier

Clustering

bad

Does it match a�known signature?

Trojan X

Ransomware Y

Is it known ??

good

Malware Analysis Sandbox

Classifier

Clustering

bad

Does it match a�known signature?

This was just one sample!!!

~450k–560k new malware samples are detected each day, contributing to over 1 billion known unique malware binaries (~20-30 years)

E.g., equation Group (APT-C-40) Sample��(analyzed 23 months before it was “discovered”)

A very complex problem

• Multi-faced problem that requires a broad set of techniques
• Data Mining
• Machine learning
• Program/binary analysis
• Reverse engineering
• OS / Hypervisor internals and design
• Network, System, Memory, Compilers
• …
• Ranges from a “microscopic” level (flipping individual bits) �to a “macroscopic” level (intelligence from billions of aggregated information)

​