Using IDAPython to Make Your Life Easier: Part 1

Posted on by Josh Grunzweig

As a malware reverse engineer, I often find myself using IDA Pro in my day-to-day activities. It should come as no surprise, seeing as IDA Pro is the industry standard (although alternatives such as radare2 and Hopper are gaining traction). One of the more powerful features of IDA that I implore all reverse engineers to make use of is the Python addition, aptly named ‘IDAPython’, which exposes a large number of IDA API calls. Of course, users also get the added benefit of using Python, which gives them access to the wealth of capabilities that the scripting language provides.

Unfortunately, there’s surprisingly little information in the way of tutorials when it comes to IDAPython. Some exceptions to this include the following:

In the hopes of increasing the amount of IDAPython tutorial material available to analysts, I’m providing examples of code I write as interesting use-cases arise. For Part 1 of this series, I’m going to walk through a situation where I was able to write a script to thwart multiple instances of string obfuscation witnessed in a malware sample. Continue reading "Using IDAPython to Make Your Life Easier: Part 1"

ProxyBack Malware Turns User Systems Into Proxies Without Consent

Posted on by Jeff White

Anonymous proxies play an important role in protecting one’s privacy while on the Internet; however, when unsuspecting individuals have their systems turned into proxies without their consent, it can create a dangerous situation. Palo Alto Networks researchers recently discovered a family of malware, designated ProxyBack, and observed over 20 versions that have been used to infect systems as far back as March 2014.

The primary distribution observed by Palo Alto Networks is focused heavily in Europe with most targets belonging to educational institutions.

proxyback1

Figure 1 – ProxyBack distribution shown in AutoFocus Continue reading "ProxyBack Malware Turns User Systems Into Proxies Without Consent"

BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger

Posted on by Bryan Lee

In late 2014, ESET presented an attack campaign that had been observed over a period of time targeting Russia and other Russian speaking nations, dubbed “Roaming Tiger”. The attack was found to heavily rely on RTF exploits and at the time, thought to make use of the PlugX malware family.

ESET did not attribute the attacks to a particular attack group, but noted that the objective of the campaign was espionage and general information stealing. Based on data collected from Palo Alto Networks AutoFocus threat intelligence, we discovered continued operations of activity very similar to the Roaming Tiger attack campaign that began in the August 2015 timeframe, with a concentration of attacks in late October and continuing into December.

The adversaries behind these attacks continued to target Russia and other Russian speaking nations using similar exploits and attack vectors. However, while the malware used in these new attacks uses similar infection mechanisms to PlugX, it is a completely new tool with its own specific behavior patterns and architecture. We have named this tool “BBSRAT.” Continue reading "BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger"

#PANWchat Wrap-Up: The 2016 Threat Landscape

Posted on by Anna Lough

Last week we hosted the first ever Unit 42 Twitter chat with several of our Unit 42 experts, including Ryan Olson (@ireo), Jen Miller Osborn (@jadefh), Robert Falcone (@r0bf4lc), and Bryan Lee (@obiwanblee). The chat, “Sure Things and Long Shots, A Look at the 2016 Threat Landscape,” tackled questions from the biggest shifts in the threat landscape to the most effective measures to protect against those threats, and the best ways people can protect themselves in 2016.

The #PANWchat also served as the official launch of the new @Unit42_Intel Twitter handle, which moderated yesterday’s chat. Make sure to follow @Unit42_Intel for the latest from our Unit 42 team.

Take a look at some of the highlights from the chat below or catch up on the entire conversation through the #PANWchat hashtag. And be sure to check out our ongoing series of predictions for 2016! Continue reading "#PANWchat Wrap-Up: The 2016 Threat Landscape"

Attack on French Diplomat Linked to Operation Lotus Blossom

Posted on by Robert Falcone

We observed a targeted attack in November directed at an individual working for the French Ministry of Foreign Affairs. The attack involved a spear-phishing email sent to a single French diplomat based in Taipei, Taiwan and contained an invitation to a Science and Technology support group event.

The actors attempted to exploit CVE-2014-6332 using a slightly modified version of the proof-of-concept (POC) code to install a Trojan called Emissary, which is related to the Operation Lotus Blossom campaign. The TTPs used in this attack also match those detailed in the paper. The targeting of this individual suggests the actors are interested in breaching the French Ministry of Foreign Affairs itself or gaining insights into relations between France and Taiwan.

We have created the Emissary tag for AutoFocus users to track this threat. Continue reading "Attack on French Diplomat Linked to Operation Lotus Blossom"

iOS Trojan “TinyV” Attacks Jailbroken Devices

Posted on by Claud Xiao

In October 2015, we discovered a malicious payload file targeting Apple iOS devices. After investigating, we believe the payload belongs to a new iOS Trojan family that we’re calling “TinyV”. In December 2015, Chinese users reported they were infected by this malware. After further research, we found the malware has been repackaged into several pirated iOS apps that are available for download via multiple channels. In this blog, we will discuss how the TinyV Trojan spreads and how it works.

Repackaging and Spreading

TinyV was repackaged into some pirated iOS apps for jailbroken devices. Infected iOS apps include “Watermelon Player (西瓜播放器)”, “Youku (优酷)”, “iQiYi (爱奇艺)” and others. After repackaging, these apps were uploaded to websites for downloading. Continue reading "iOS Trojan “TinyV” Attacks Jailbroken Devices"

Palo Alto Networks Researchers Discover Critical Vulnerabilities in Internet Explorer and Microsoft Edge

Posted on by Ryan Olson

Palo Alto Networks researchers Bo Qu and Hui Gao were credited with the discovery of three new critical Microsoft vulnerabilities affecting Internet Explorer (IE) versions 7, 8, 9, 10 and 11 and Microsoft Edge. These vulnerabilities are covered in Microsoft’s December 2015 Security Bulletin and documented in Microsoft Security Bulletins MS15-125 and MS15-124.  Continue reading "Palo Alto Networks Researchers Discover Critical Vulnerabilities in Internet Explorer and Microsoft Edge"

Palo Alto Networks Researchers Discover High Severity Vulnerability Impacting Apple’s Major Products

Posted on by Ryan Olson

Palo Alto Networks researchers Tongbo Luo and Bo Qu are credited with discovering a new vulnerability (CVE-2015-7066) in OpenGL and Webkit that impacts all of Apple’s major products, including: Continue reading "Palo Alto Networks Researchers Discover High Severity Vulnerability Impacting Apple’s Major Products"

BackStab: Mobile Backup Data Under Attack from Malware

Posted on by Claud Xiao

Today we are releasing a whitepaper describing how malicious actors are stealing private mobile device data by accessing local backup files stored on PC and Mac computers. We have identified 704 samples of six Trojan, adware and HackTool families for Windows® or Mac® OS X® systems that used this technique to steal data from iOS and BlackBerry® devices. These attacks have been in the wild for over five years, and we have observed them deployed in over 30 countries around the world.

Since these families use a common attack technique to access the backup files, we categorize all of them as using the “BackStab attack,” defined as “an attack approach that captures private mobile device data through the theft of local backup files stored on PC and Mac computers.”

The BackStab attack technique poses a risk to many mobile users for the following reasons: Continue reading "BackStab: Mobile Backup Data Under Attack from Malware"

Rootnik Android Trojan Abuses Commercial Rooting Tool and Steals Private Information

Posted on by Wenjun Hu

We recently analyzed a Trojan named "Rootnik" which uses a customized commercial root tool named “Root Assistant” to gain root access on Android devices. By reverse engineering and repackaging this tool, the creators of Rootnik successfully stole at least five exploits that give them root access to Android devices that are running Android 4.3 and earlier. Root Assistant was developed by a Chinese company to help individuals gain root access to their own devices. However, Rootnik uses this tool to attack phones all over the world. Based on the data we have collected, Android users in United States, Malaysia, Thailand, Lebanon and Taiwan have been affected by the Trojan thus far.

Rootnik was able to spread by being embedded in copies of legitimate applications: Continue reading "Rootnik Android Trojan Abuses Commercial Rooting Tool and Steals Private Information"

Adversaries and Their Motivations (Part 3)

Posted on by Rob Downs

adversaries1

In part three of the Adversaries and Their Motivations blog series, we’ll explore the following top-level actor motivations: Cyber Warfare, Cyber Terrorism, and Cyber Mischief.

Even Fuzzier Boundaries

The high-level actor motivations covered earlier in this blog series introduced challenges in identifying and attributing activity between Cyber Espionage, Cyber Crime, and Cyber Hacktivism.

Analysis of the remaining motivations covered in this blog post can be even fuzzier considering the following: Continue reading "Adversaries and Their Motivations (Part 3)"

Attack Campaign on the Government of Thailand Delivers Bookworm Trojan

Posted on by Robert Falcone

Unit 42 recently published a blog on a newly identified Trojan called Bookworm, which discussed the architecture and capabilities of the malware and alluded to Thailand being the focus of the threat actors’ campaigns.

In this blog, we will discuss the current attack campaign along with the associated threat infrastructure and the actor’s tactics, techniques and procedures (TTPs). The following list provides a summary of the threat actors TTPs, which we will cover in this blog:

Continue reading "Attack Campaign on the Government of Thailand Delivers Bookworm Trojan"

Inside TDrop2: Technical Analysis of new Dark Seoul Malware

Posted on by Josh Grunzweig

Palo Alto Networks recently identified a new campaign targeting the transportation sector in Europe with ties to the Dark Seoul and Operation Troy campaigns that took place in 2013. This new campaign used updated instances of the Tdrop malware family discovered in the Operation Troy campaign. For more information on the new campaign discovered by Unit 42, please refer to our recent blog post.

In this attack, attackers embedded the TDrop2 malware inside a legitimate video software package hosted on the software distributor’s website. By doing this, they were able to target organizations that relied on the distributor’s security camera solution and infect their systems with malware. They created a true Trojan horse, which sneaks into a network as a gift, but when opened, the attacker’s army leaps out.

Continue reading "Inside TDrop2: Technical Analysis of new Dark Seoul Malware"

Our Commitment to Sharing Threat Intelligence

Posted on by Ryan Olson

Part of my role as the Director of Threat Intelligence for Palo Alto Networks is to share the intelligence we produce with others who can put it to use in defending their networks. We believe wholeheartedly that having better information about the threats you face will help you defend yourself from harm. Knowing what kinds of actors are targeting you, what tools they have available, and what tactics they employ allows you to structure your defenses more effectively than against a generic, non-specific threat.

As a global security vendor, we have insight into attacks occurring across every industry and all around the world. Rather than hold this information close to our chest, we choose to share much of it with the security community. In the last 18 months, we’ve published over 100 entries to our threat intelligence blog, detailing new attacks, revealing attacker infrastructure, and educating our readers on what they can do to defend themselves. Some recent examples include: Continue reading "Our Commitment to Sharing Threat Intelligence"

Upatre: Old Dog, New [Anti-Analysis] Tricks

Posted on by Brandon Levene

Malware authors must constantly iterate on their techniques in order to stay relevant in today’s fast moving Information Security environment. The Upatre downloader has been around for nearly three years and has consistently evolved its anti-analysis capabilities to better ensure payload delivery. Using Palo Alto Networks AutoFocus, we identified several thousand functionally identical Upatre binaries with unique hashes that exhibited unusual anti-analysis behaviors. We dove into the most recent phishing campaign to identify the new anti-analysis routines designed to maneuver around behavioral analysis systems.

Diving In

Upatre’s new technique takes advantage of undocumented NtQuerySystemInformation structures. It attempts to call the ZwQuerySystemInformation API a few times to determine the idle time of the system. The ZwQuerySystemInformation API takes a SYSTEM_INFORMATION_CLASS as an argument for what to query. There are several options to query for, all with respective structures. Continue reading "Upatre: Old Dog, New [Anti-Analysis] Tricks"

Get the latest news, invites to events, and threat alerts

Default Heading

Read the article Right Arrow