Tracking the entire iceberg - long-term APT malware C2 protocol emulation and scanning Who am I? @cci_forensics Past Research VB 2022 https://twitter.com/cci_forensics https://speakerdeck.com/takahiro_haruyama Motivation Motivation VB 2022 is IP address as malicious >OMMUNITY Abusix ADMINUSLabs AlienVault Antiy-AVL AutoShun Overview VB 2022 Target Summary Winnti 4.0 ShadowPad Prevalence Low High First-observed year 2016 (start-up sequence), 2018 (new C2 protocol) 2015 Scanning start year 2019 2021 Supported protocols TCP/TLS/HTTP(S)/ UDP TCP/SSL/HTTP(S)/ UDP/DNS Unique feature Server-mode Multiple protocol listening at a single port Winnti 4.0 VB 2022 Winnti Malware Kaspersky Novetta VB 2022 https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20134508/winnti-more-than-just-a-game-130410.pdf https://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf Winnti Malware 4.0 Macnica Networks version 4.0 VB 2022 Version 3.0 Version 4.0 Initial component Dropper Loader and DAT file Initial encryption algorithm DES AES Initial encryption key cracking Easy Hard Worker encryption 1-byte XOR and nibble swap DPAPI or AES with host- specific key https://www.jpcert.or.jp/present/2018/JSAC2018_09_yanagishita-takeuchi.pdf https://blogs.vmware.com/security/2019/09/cb-tau-threat-intelligence-notification-winnti-malware-4-0.html Winnti Malware 4.0 (Cont.) VB 2022 struct struc_work_config { char campaignID[64]; char MAC_addr[6]; int c2_proto; // enum_proto ... } enum enum_proto { none = 0x0, TCP = 0x1, HTTP = 0x2, HTTPS = 0x3, TLS = 0x4, UDP = 0x5, }; C2 Protocol VB 2022 Packet Format VB 2022 struct struc_custom_header { __int16 temp_key_seed; __int16 unk_word; // initial value is 2 __int16 signature; // 0x45DB int payload_len; }; struct struc_custom_payload_init { int payload_type; // request:0xEE775BAA/0x4563CEFA/0x5633CBAD, response:0xFACEB007/0x5633CBAD int unk_dword; // request:0, response:0xC350/0xC352 GUID guid; char null_bytes[14]; __int16 seq_num; // starting from 1 __int16 null_word; }; Encryption AppCall VB 2022 https://www.hex-rays.com/wp-content/uploads/2019/12/debugging_appcall.pdf HTTP Protocol VB 2022 Customized packet Customized packet size HTTP: Size Calculation from Cookie Value VB 2022 $ python validate_cookie.py 640ABEFB16D2CE36E7E83E1B8BEF31B2500ABEFB dw0=0xfbbe0a64, dw1=0x36ced216, dw2=0x1b3ee8e7, dw3=0xb231ef8b, dw4=0xfbbe0a50 The cookie value validated. dword key = 0x34 HTTP: Dummy Data in GET Request VB 2022 Size = 0 Size = 0 Behavior After the Initial Handshake VB 2022 struct struc_nested_payload // at least 0x14 bytes { // e.g., cmd_ID=5 & dispatch_ID=1 order to send victim info __int16 cmd_ID; __int16 dispatch_ID; ... int additional_data_len; struc_data_cmd1 additional_data; // flexible size }; struct struc_custom_payload_next { __int16 messageID; ... __int16 signature; // 0x45db int nested_payload_len; struc_nested_payload nested_payload; }; Scanner Implementation VB 2022 ZMap • Internet-wide port scan • TCP 443 & 80 • UDP 443 & 53 (customized packet required) Stand-alone Python Script • HTTP(S): Decode and Validate Cookie value • Others: Get suspicious responses with the same size and different key IDAPython AppCall • Decrypt response’s customized packet • Validate signature and payload size in the header How to Differentiate Server-mode Infections and C2 Servers [DEBUG] server header: unknown word = 0x2, header signature = 0x45db, payload length = 0x2a [*] server payload: payload type = 0xfaceb007, unknown dword = 0xc352, GUID = 0b8212dc- e364-4c18-ac0b-26382beb1387, sequence number = 2 [DEBUG] server header: unknown word = 0x2, header signature = 0x45db, payload length = 0x2a [*] server payload: payload type = 0xfaceb007, unknown dword = 0x0, GUID = 00000000-0000- 0000-0000-000000000000, sequence number = 1 Server-mode: the same GUID as client, sequence number incremented C2: null GUID, sequence number reset VB 2022 Result: Population by Protocol VB 2022 TLS 35% HTTPS 29% HTTP 20% TCP 11% UDP 5% TLS HTTPS HTTP TCP UDP Result: Change in Number of Active C2s VB 2022 0 5 10 15 20 25 Dec -1 9 Fe b-2 0 Apr -2 0 Jun -20 Aug -20 Oct- 20 Dec -2 0 Fe b-2 1 Apr -2 1 Jun -21 Aug -21 Oct- 21 Dec -2 1 Fe b-2 2 Apr -2 2 Jun -22 Aug -22 nu m be r of a ct iv e C 2s period 1st disclosure 2nd disclosure Public Reports Related to Winnti 4.0 C2s Trellix Recorded Future VB 2022 https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/operation-harvest-a-deep-dive-into-a-long-term-campaign.html https://go.recordedfuture.com/hubfs/reports/cta-2021-0921.pdf ShadowPad VB 2022 ShadowPad Malware SentinelOne VB 2022 https://www.sentinelone.com/labs/shadowpad-a-masterpiece-of-privately-sold-malware-in-chinese-espionage/ C2 Protocol TCP HTTP(S)/UDP Key size 4 2 Header size 0x14 8 Payload size in the initial handshake packet Up to 0x3F HTTP(S): Up to 0x1F, UDP: 0x10 VB 2022 C2 Protocol (Cont.) VB 2022 Variant name C2 protocol Config size Attribution Source Variant1 (aka ScatterBee) TCP/UDP 0x896 APT41 Positive Technologies Variant2 HTTP(S) 0x85C Tonto Team ESET Variant3 HTTP(S) 0x85C unknown Positive Technologies https://www.pwc.co.uk/issues/cyber-security-services/research/chasing-shadows.html https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/ https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/ TCP Protocol QuickLZ VB 2022 struct struc_common_header { int session_key; int plugin_and_cmd_id; // plugin_id (0x68) << 16 + cmd_id (0x51) by Variant1 int module_code; // 0 int payload_size_compressed; // QuickLZ int payload_size_original; }; https://github.com/RT-Thread-packages/quicklz TCP Protocol (Cont.) Dr.WEB white paper VB 2022 https://st.drweb.com/static/new-www/news/2020/october/Study_of_the_ShadowPad_APT_backdoor_and_its_relation_to_PlugX_en.pdf HTTP(S) and UDP Protocols VB 2022 struct struc_proto_header { __int16 session_key; __int16 type; // 0 in HTTP, req=0x1001/res=(0x2002|0x5005) in UDP __int16 session_src_id; // random 2 bytes, generated by both client/server __int16 session_dst_id; // req=0, res=client's session_src_id }; HTTP(S) and UDP Protocols (Cont.) VB 2022 UDP packet encoding by Variant1 HTTP(S) packet encoding by Variant2 HTTP(S) packet encoding by Variant3 HTTP(S) and UDP Protocols (Cont.) VB 2022 struc_proto_header payload = TCP packet struc_common_header QuickLZ-compressed payload Scanner Implementation VB 2022 Scanning start period Target protocol/port/variant September 2021 HTTP/443 (Variant2 & Variant3) October 2021 TCP/443 & UDP/53 (Variant1) June 2022 UDP/443 (Variant1), HTTP/80 (Variant3) Scanner Implementation (Cont.) VB 2022 ZMap • Internet-wide port scan • Targets as mentioned previously Stand-alone Python Script • Decode the response packet • Validate the decoded values • TCP: payload size fields • HTTP(S)/UDP: type and session_dst_id Multiple Protocol Listening at a Single Port VB 2022 [*] config size = 0x85c .. [+] C2 Entry 0 (offset 0xbc): 'HTTPS://wwa1we.wbew.amazon-corp.wikaba.com:443' [+] C2 Entry 1 (offset 0xed): 'HTTP://wwa1we.wbew.amazon-corp.wikaba.com:443' .. SHA256: d011130defd8b988ab78043b30a9f7e0cada5751064b3975a19f4de92d2c0025 Hostname/port matched Multiple Protocol Listening at a Single Port (Cont.) VB 2022 $ ./c2fs.py -d -l corpus/query.txt -p 443 -f sp httpVariant2 .. [*] malware options: family = ShadowPad; targeted protocol = http (version = Variant2) [*] ShadowPad specific options: version = Variant2; key size = 2; key endian = big; header size = 0x8; header type = 0x0; client session ID = 53978 [D] POST: http://137.220.185.203:443/ (proxy={}, stream=True, timeout=30) [+] 137.220.185.203,active,client session ID matched (type=0x0) .. $ ./c2fs.py -d -l corpus/query.txt -p 443 -f sp httpsVariant2 .. [*] malware options: family = ShadowPad; targeted protocol = https (version = Variant2) [*] ShadowPad specific options: version = Variant2; key size = 2; key endian = big; header size = 0x8; header type = 0x0; client session ID = 52256 [D] POST: https://137.220.185.203:443/ (proxy={}, stream=True, timeout=30) [+] 137.220.185.203,active,client session ID matched (type=0x0) Result: Population by Variant VB 2022 Variant1 49%Variant3 41% Variant2 10% Variant1 Variant3 Variant2 0 5 10 15 20 25 Se p-2 1 Oct- 21 Nov -2 1 Dec -2 1 Jan -22 Fe b-2 2 Mar- 22 Apr -2 2 May -22 Jun -22 Jul -2 2 Aug -22 nu m be r of a ct iv e C 2s period Result: Change in Number of Active C2s VB 2022 System issue Samples Communicating with C2 IPs VB 2022 Sample Malware family C2 IP address C2 Protocol/Port used by sample Sample submission date on VT C2 first-seen date by scanner C2 last-seen date by scanner Spyder 156.240.104.149 TLS/443 2021/10/26 2021/10/16 2021/10/16 ReverseWindow 43.129.188.223 TCP/10333 2022/02/27 2021/10/17 2022/06/14 ShadowPad 213.59.118.124 UDP/443 2022/03/20 2022/03/06 2022/06/13 https://st.drweb.com/static/new-www/news/2021/march/BackDoor.Spyder.1_en.pdf https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_301_shui-leon_en.pdf Incident Response Case Triggered by Discovered C2 VB 2022 Notes for Internet-wide C2 Scanning VB 2022 How to Get Input (Port Scan) Data scanning target ports VB 2022 ZMap Shodan CenSys TCP/10333 4,940,037 4 1,306 TCP/55555 3,199,856 86 486,497 Note: The data was collected in 2021/11 https://api.shodan.io/shodan/ports Anonymization VB 2022 Tor Commercial VPN service Cost Free Non-free Supported protocols TCP TCP/UDP Risk of being blocked High Low https://www.torproject.org/ Anonymization (Cont.) ZMap issue VB 2022 https://github.com/zmap/zmap/issues/580 Wrap-up VB 2022 Wrap-up VB 2022 Acknowledgement VB 2022 Indicators of Compromise VB 2022 Indicator Type Context 0a3279bb86ff0de24c2a4b646f24ffa196ee639cc23c64a 044e20f50b93bda21 SHA256 Winnti 4.0 dat file 03b7b511716c074e9f6ef37318638337fd7449897be99 9505d4a3219572829b4 SHA256 ShadowPad Variant1 aef610b66b9efd1fa916a38f8ffea8b988c20c5deebf4db8 3b6be63f7ada2cc0 SHA256 ShadowPad Variant2 d011130defd8b988ab78043b30a9f7e0cada5751064b3 975a19f4de92d2c0025 SHA256 ShadowPad Variant3 1ded9878f8680e1d91354cbb5ad8a6960efd6ddca2da1 57eb4c1ef0f0430fd5f SHA256 Spyder communicating with the ShadowPad C2 (156.240.104.149) 536def339fefa0c259cf34f809393322cdece06fc4f2b37f 06136375b073dff3 SHA256 ReverseWindow communicating with the ShadowPad C2 (43.129.188.223) 9447b75af497e5a7f99f1ded1c1d87c53b5b59fce224a3 25932ad55eef9e0e4a SHA256 ShadowPad Variant1 communicating with the ShadowPad C2 (213.59.118.124) Questions? VB 2022