so what patrick said we're going to be
talking about my lord behavior you know
we've seen a lot of very heavyweight
talks today so I'm going to give your
brain a little bit of a rest here this
is not going to be really really deep
it's gonna be very high-level come on
so a little bit about myself my name's
going to read for those of you that
don't know I work for malwarebytes and
when I am NOT you know managing products
or reversing malware or what my I am an
avid photographer so let's jump right in
here we got 25 minutes so let's look at
some specific behaviors that malware
generally likes to have so persistence
obviously that's a big one you know if
malware can't stay running what good is
it now in certain cases it's not that
important but the majority of the time
our wants persistence
now we're also often like to make system
configuration changes so we have changes
to various system files posts file and
pseudo response stuff like that
installing system configuration profiles
that sort of thing
Wow malware likes to be hidden as well
obviously so there are a variety of ways
that malware tries to stay hidden on the
system and in malware needs met with
communication as well you know for
downloading additional payloads works
with trading data you know so obviously
those are some pretty important
capabilities that malware has to have
problem is these are also all things
legitimate applications have to be able
to do so where where do you draw the
line like what's what's malware and
what's not so the difference here really
keys off of
that those differences and what kind of
behaviors are suspicious and which ones
are not and sometimes this is a very
blurry line sometimes it's very very
sharp like just depends so we're gonna
look at a whole bunch of these kinds of
suspicious behaviors that you might see
so we're going to start with kind of you
know the easy obvious stuff so launch DT
lists we've talked a lot about launch
agents and launch statements so here's
an example this was found in some
malware that we identify as bad word
that's more because John Lambert who
discovered it didn't really name it and
we had to call it something in our
database so you know that's what we
called it and this malware basically it
was a Microsoft Word macro that there's
sandbox escape and wrote appeals filed
to the system interestingly it actually
stole the code from Adam Chester who
wrote a proof of concept or even the
name of this thing is from his website
so but obviously here you see in this P
list if you can see it back in the back
there's Python code being executed
straight from the feuless file next like
you'll never see that and illegitimate
see what's at least you shouldn't we
would hope he'd never see that in legit
must be less in this case that opened up
laments work through their blackboard
hello sis he launched the affiliates
that are pretending to be apples who
look very common technique it's kind of
a lame technique and I wonder how often
it actually works but I see it all the
time so you can see in its screenshot
here those are just the examples from
eagle egg dark miner and lane pyre all
of which are cleared last year late last
year
so that's highly suspicious the problem
here is that there are few legitimate
con by Apple the duck you lists that
you'll see outside the system folder so
you can't just automatically assume that
every comes out Apple not Felix that you
see in the user is launched against
directory or some somewhere like that
it's automatically back some are
actually legit cron tasks have been
mentioned a couple of times over the
course of the conference here these days
cron tests really are not used much I
think the only thing that I've seen a
contest for in legitimate software
lately was really old versions of super
duper so really if you see a crime task
being used it's probably malicious
unless maybe you set it up yourself so
here we got two different examples
fun-tana cron abuses the top one there's
from some malware that with healthy
search it's also called parrot which was
discussed yesterday and here it's just
running a process called stateliness
that hu nothing suspicious about that at
all
and in the bottom line here was actually
from a old word macro malware and you
can see it calls this you know Apple
script that does a shell script that
writes a file out and loads it up in
cron and then deletes the file so you've
got this task going in all times but
there's no evidence left on the library
but you can still see that the crime
task is there we mentioned sue Delores
file changes as one of the system
configuration changes that Mary likes to
make you can see here two examples from
the malware doc
and proton the top one was from Doc and
what that does is it allows the the
current user which was text in this case
to do anything let's do that without
having to have a passwords the bottom
one there was from Croton and that
basically sets the system so that there
is one single pseudo channel going
so most of the time on mac OS we open up
two terminal windows and you do sudo in
one of them it starts up a timer going
you have certain lifetime to continues
include out before ask you for a
password email the other terminal window
does not have that same timer going you
do sudo in there it takes our two new
timer this actually makes it so that if
you do we go any process anywhere on the
system can then you see that without a
password on see if you can imagine
malware could sit there in the
background just waiting for you on
something of sudo and then pounce on
that and get that privilege isolation
and these would typically be used in
cases where the malware was able to
somehow get root access to write to
these files but maybe didn't have
continued root access to do later
operations and wanted to be able to have
that capability
folks file also only one that's commonly
manipulated most of the time that I see
it manipulated it's actually because
somebody has installed a pirated version
of some what they'll be product so if
you see that it's not malicious but it's
highly suspicious and that machine
probably needs a little once-over just
to make sure the user hasn't it's about
something they shouldn't have but some
malware such as doc which we'll be
referring to repeatedly to dispense of
very interesting things actually use
this to block a whole bunch of Apple
servers as well as virus total
so that's really really suspicious you
should not see either of those getting
blocked in a closed file another
research example here and they're going
to be several these kind of chained
together so research or peer it use the
hidden user so when it installed on the
system it would create a user with an
idea 401 which means that it's totally
hidden doesn't show up in system
preferences or anywhere else you kind of
have to know what you're doing to spot
the user and if this user was used with
a PF rule and it was used to run a proxy
so all the users HTTP traffic is proxy
through process music that was running
under that user so this was a good way
to hide that proxy and keep it from
being notice and it was a good way also
to for research to actually inject that
into your HTTP traffic this could very
easily have been used to sniff your
traffic fortunately it wasn't but in
general a hidden user is a big red flag
and if your systems got PF fools on it
that you don't know where there that's
also a huge red flag another case of
proxy settings is in dot doc you can see
here it raineth proxy through four five
five five five on the localhost and it
did it differently so we've got to kind
of keep an eye on a variety of different
ways that Foxy's can be set up in proxy
settings PF rules etc another way we
proxying is through trusted certificates
so you kind of have to keep an eye on
your keychain and making sure that there
aren't some weird certificates in there
that shouldn't be there
so the dot malware actually installed
this Komodo
certificate here on the right side and
it used that to proxy legislature to
complete with HTTP traffic in that case
the intent was not to inject that but
actually the sniffed of traffic we've
also seen MIT M proxy which is an
open-source proxy tool lately that has
been used in a lot of adware and malware
both for the purposes of injecting ads
and sniffing traffic and as was
mentioned yesterday titania and web
proxy is another one that's now joining
the fray and is being abused by malware
both of those last two they're
completely legitimate open source
there's nothing wrong with them but if
you see them on a system and you don't
think that user has a reason to have
them there that's a huge red flag
probably they're there for malicious
purposes process behavior is another big
thing if you got out of that so for
example anything that's running from
temp if you look at the list of running
processes and something's running from
temp that's a huge red flag Slayer is
just one example here but there are many
many others most adware droppers will do
this sort of thing you know well down
they'll curl something down into the
temp folder and then run it so in this
case Lister shows that it's Slayer was
running a script that curled a file down
into into the temp folder image one and
I think we've seen that code already at
least twice maybe so Slayer has been
well covered at this conference running
from hidden locations that's also
another nono and when I say hidden
locations I don't mean like you know
slash user because that's
it's hidden folder but it seemed fairly
normal for processes to be running out
of there I mean kiddin
as in like some weird folder that starts
the name starts with a period so it's
hidden from the user that's not the way
that Apple typically does things so and
it shouldn't be the way that normal
legitimate software does things either
you can see in this case with evil egg
in this keyless fire it's running a an
executable that is invisible from a
folder that is also invisible and that's
really really suspicious in the case of
real clang spine it was actually an
application that was made invisible and
loaded through a long on a logging item
instead of a launch aging process
behavior here you know this is just
another way that some of these my work
gets installed it's it's through our
Apple script or Automator scripts which
is kind of interesting and it's weird
because all this is is a carrier for a
shell script so in both the case of dart
minor and leng fire automated scripts
were used and their entire purpose was
to do nothing before on a shell script
so this one here this is from Darth
minor you can see that it curls
something down from kind of a weird URL
and then types it the Python and then it
curls something else down and unpacks it
and runs it so that's pretty suspicious
obviously just that behavior itself and
the fact that it's wrapped up in an
automated script is even worse now in
the case of lame Peyer the script was I
it was kind of laying malware but the
script was much more interesting so it
had this long bit of
laid 64 encoded data and it took that
and decoded it and piped it into Python
and then after while that was running it
went into this loop here and it started
doing a screen capture and it did it in
such a way so that that's the sound
wouldn't play so you wouldn't know the
screen capture clip and I saved it and
the temp folder as a file named alloy
dot PNG and Hawaii that file lame and it
used perla upload that to a command and
control server and it be this over and
over and over and over again as fast as
it could so as soon as it's created and
uploaded a screen capture it's doing it
all over again
this was cannon even though I mean
obviously there's this is a lot of web
traffic going out because it's basically
constantly uploading something but even
worse the whole time this was running up
in the menu borrows a little gear icon
for Automator just going around and
around and around
I think somebody mentioned that
yesterday and said that you could make
it so that it would just run for like
half a second and then go away evidently
they didn't know how to do that so it
just would keep going and going and so
it was right there just sort of waving
like a big red flag at you network
connections are another thing to look at
especially network connections to tor
now tor is a legitimate thing it's not
malicious in and of itself but if you
see a weird process that shouldn't be on
the system communicating with tor and
that's a problem in this case doc used
this key list here combine Apple dot
Safari that proxy that plist nothing
suspicious at all they arranged and you
can see here in this code it was
directly running an open source tool and
using that too
Boxey traffic through a dot onion
address so that's like just about
everything about this is the surface but
specifically if we look at that tor
traffic going out through some random
key list file you know a processing
launched by a random PS file that's
that's really sketchy we also have seen
lately a growing number processes signed
not with an apple certificate but with
ad-hoc service I'm kind of shocked that
this still works
I would think that Apple would not want
this to work at all because these are
things that can run because they're not
unsigned but Apple has no control over
the making Apple can't revoke the
certificate so this was done by both
research and some adware that was
otherwise pretty uninteresting that we
call face bump the imitated the face
book down and if you look at the code
sign information for both of those
you'll see team identifier is not set
senators listed is at ha the bundle
identifier can be it can look legitimate
or it can become sticky like that I
don't know what they were thinking with
UPD - some long number that didn't look
at all like I come to life in a fire but
if you see applications that are signed
like this that's a really really big red
flag much JavaScript as an app
executable so you know it's you're used
to seeing a mocker binary in there it's
the executable inside of an app but you
can actually replace that with a shell
script the only time I've ever seen that
then has been with Slayer which I'm not
going to die a more deeply into this
script here because it's already been
discussed at least twice over the course
of the
conference but suffice it to say that if
you follow this sprint through you'll go
down a deeper Abbott hole of repeating
you know och you skated scripts and
curls and etc etc and it all starts off
from this shelf script inside the app
bundle in the contents Mac OS folder
which is really weird so if you see that
that's that's not right no legitimate
software does that and then a couple
more items here regarding installation
so in this case we're talking about
research research and this is kind of an
older version of research we did some
analysis avoidance directly in the
install process so inside the PHP file
it had a pre installed script that pre
installed script I've trimmed out a lot
of it because a lot of it's fairly
uninteresting but if you look here what
is doing is it's calling IRA and it's
getting some information about the
device and then it's typing it through a
whole bunch of sequences of you know off
and graft and whatnot
to try to get the vendor main rather
there and you can see very very clearly
there it's it's not even obfuscated in
any way it's looking for parallels
VirtualBox Oracle and VMware and that
was fairly effective at actually
detecting of the end and bailing out so
you can see there it says is the N
equals 1 is being 2 or N equals 0 and so
if it was in at the end it would play
along after that this was pretty easy to
get around if you have this sample you
just as Jared was talking about you you
expand the package of two pages we you
tell you've changed that if else and you
flatten it again and this wasn't signed
in anyway
worry about a signature so but that kind
that kind of behavior that kind of
analysis avoidance is really really very
common in malware it's not always quite
this obvious you know there has been
some discussion about analysis avoidance
is very sneaky at the conference this is
just blatant and it's easy to spot
unfortunately they're not really doing
it this way anymore it's not going to be
sneakier and you don't see this kind of
obvious analysis avoidance anymore and
then we've got flashback now this is a
this is a flashback to almost a decade
ago at this point so this is very very
old malware and it actually did the
installation in the pre install script
so you run the PKG file and you know
maybe maybe you decide to bail out and
you cancel the installation quickly
installer too late it's already been so
this kind of thing is pretty nasty so
you can see here actually and this takes
the pre-installed script was a makkah
binary which is fairly rare I mean as
was mentioned you couldn't have really
anything as the pre-installed script but
traditionally it's a looks like a bash
sometimes I guess Colibri script or
something like that is Darren mentioned
in this case it was a mock those binary
I think this is the only time I've ever
actually seen that and a hopper on a
screen shot would have been a little bit
too big to really meaningfully displayed
here so it's just sort of stuck there
showing you Springs just to make sure
that you can see it in the back I'll
zoom in a little bit so you can see a
lot of nasty things here you can see a
reference to Little Snitch
so this
script would actually look for the
presence of Little Snitch and if Little
Snitch was present it would bail out it
would not install on any of the stuff
but if any of its payload and the reason
for that is that this was going to
exfiltrate some information and if a
little snitch was there when you get
with you so and you can also see how
number of other nasty things like like
that outline there that it did launch
control load and then accept an
environment variable it set a dynamic
library to be inserted into the system
so lots of nasty stuff there there's a
you know an su command in there there's
I mean all kinds of nasty stuff
it's and this was all done in the free
install script so it happened before you
even it like you would never have
realized that anything has been
installed if you didn't complete the
installation process and that's
something that I'm kind of surprised we
haven't seen more up because the pre
install script is the perfect place to
drop some nasty stuff on your system
yeah because it happened so early in the
process so that is it pretty short and
sweet any questions all right
what's the craziest thing you've seen
recently in the rock so you'd say well
that is mind-boggling the kind of
interests craziest I there really hasn't
been anything really wildly crazy lately
it's actually been kind of quite this
year we've seen a lot of ad rare a lot
of pups the worst stuff we're seeing
right now really comes from the foot
world you know we're seeing things like
lots of it kind of like polymorphism
we're seeing a lot of pups that are
proliferating in numbers and every
single one has a different name and the
one in question here that I'm thinking
of it started out as advanced Mac
cleaner so you guys are probably at
least some of you are probably familiar
with that it'll put up a window and
it'll actually yell at you it'll say you
know your system is I forget the exact
wording something's wrong with your
system after seeing it now so it's
really tried to scare you and then all
these other variants of it are all exact
duplicates of that found well and there
are dozens and dozens of them at this
point and more more caring almost every
day so but yeah like as far as really
cool interesting we're really not seeing
it you know we've got all these
theoretical exploits we've seen some
really great surveys and with this
conference and nobody's using them in
the wild
last year I presented about code signing
and how you could use that to actually
establish persistence by learning and
application and still you know like
nobody's done it my paper is out there
it's at the virus but like if it gets up
on the virus Bolton website you sound
disappointed
and there was yeah I mean all of us in
this room we could do and each and every
one of us could do my work letters in
the malware off
right now and I don't understand why
it's not being done not that not that I
want it but it would make my life more
interesting
yeah do you see soccer wear on my cattle
and what does Malwarebytes
policy for classifying that yeah that's
a good question
we definitely do see stocker where that
has become a big big thing these days
lots of talk about it we have actually
been very strong against soccer where
before it became called soccer where you
know it's we will detect any kind of not
just malicious spy there but you know
so-called legitimate spyware that you
can go to a website and buy which I
guess is what they're referring to when
people say stalker where and will detect
all of that stuff and we have on the Mac
side we have since I've been with the
company basically since the product
first existed