Malware 101 “Basics” - ROOTCON

Malware 101Malware 101“Basics”Berman Enconado

Malware 101Malware is malicious softwareHow to identify? Stealing informationUnauthorized accessExploitsFooling the unsuspecting user

Malware 101en.wikipedia.org/wiki/Malware

Malware 101Classification of MalwareMalwareGraywareGoodware

VirusesFile HeaderEntry PointMalware 101File HeaderFile HeaderHost CodeHost CodeEntry PointHost CodeUninfectedHostVirus CodeVirus CodeInsertionEntry PointVirus CodeInfectedHost(HeaderUpdated)

ExploitsExploited WinAmpPlaylist (m3u file)Malware 101

Trojan / BackdoorMalware 101Network/InternetServerComponentClient ComponentVictimAttacker

Trojan / Backdoor Malware 101Dropped files– Usually in %windows% or %system% directories Autostart– HKEY LOCAL Run– HKEY LOCAL RunOnce– HKEY LOCAL MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon– %USERPROFILE%\Start Menu\Programs\Startup

RootkitMalware 101

WormsThe famous “LoveBug” aka ”I loveyou” worm. Not avirus but a worm.(Filipino-made)Malware 101

Malware 101Brief History of MalwareTheories forselfreplicatingprograms arecreatedFirst Applevirus found“in the wild”- Spreadsthroughpirated gamesMacro nganddestructiveviruses startsto becamerampantILoveYou“virus”Sends viaemailMelissa-Emailspammer- uses MSWorddocumentsSlammerWormConfickerWorm- fastestspreadingworm to date;infecting75,000computers inapproximatelyten minutes- Mostnumber ofcomputersinfected sinceSlammer in2003TDLStuxnetRustockRootkitsMobile

Malware Researcher NotesMalware 101A malware installs itself in the systemwithout any notification or dialogsA legit application gets installed by asetup with a sequence of notificationsor dialogs

Malware 101Tools anyone can use to determine systeminfection.

Malware 101Process Explorer

Malware 101Installrite

Malware 101Wireshark4sysops.com

Malware 101Autoruns

Malware 101GMERLavasoft.com

Malware 101Malware 101“Clean-up”Reginald Wong

Malware 101Installation SetupLegit AppversusMalwareInstalls using a dialogNo dialog. May show fake error orimage such as pornUsually installs its components inProgram Files folderUsually installs itself in the Windowsfolder(s)Can be manually run from StartPrograms MenuIt is already running and triggered at asystem event such as startup.

Comparison: ProcessBeforeAfterMalware 101

Malware 101Comparison: FileBeforeAfter

Comparison: RegistryBeforeAfterMalware 101

Comparison: RegistryMalware 101BeforeAfter

Comparison: RegistryBeforeAfterMalware 101

Malware 101

Malware 101Assuming we do not have any third-partytools, and we only have our plain oldWindows NT-based OS .

Common Malware File LocationsMalware 101 Located in– Windows folder or subfolders like System32.i.e. C:\Windows\System32– Recycle(r) folders– Desktop And can be found set to run at startup

Looking for Suspicious FilesClick onStart- RunThen type,MSCONFIGAnd hitENTERMalware 101

Looking for Suspicious FilesClick onStart- RunThen type,TASKMGRAnd hitENTEROrPressCTRLSHIFT-ESCMalware 101

Suspicious Files: File PropertiesMalware 101 Version Information– Google is your very best friend File version Company Name Copyright Icon– Trying to mimic a folder, explorer, or any legitapplication. Check out the path.– No icon

Suspicious Files: File PropertiesMalware 101

Suspicious Files: File PropertiesMalware 101

Looking for Suspicious FilesMalware 101

Looking for Suspicious FilesMalware 101

Looking for Suspicious FilesStill notshowing up?!?Malware 101

Looking for Suspicious FilesMalware 101Unhide using ATTRIB(command line app)

Looking for Suspicious FilesMalware 101

Looking for Suspicious FilesMalware 101

Removal: Attempt to Delete FileMalware 101

Removal: Attempt to Terminate ProcessMalware 101Unfortunately Failsto Terminate

Removal: Attempt to Delete FileMalware 101HKEY LOCAL MACHINE\SYSTEM\CurrentControlSet\Control\Session ManagerClick onStart- RunTypeREGEDITHit ENTER

Removal: Attempt to Delete FileMalware 101

Removal: Attempt to Delete FileMalware 101

Removal: Attempt to Delete FileMalware 101Pad 2 0x00 bytes which means Renaming the file tonothing. In other words, delete.

Removal: Attempt to Delete FileMalware 101

Removal: Attempt to Delete FileMalware 101

Removal: Attempt to Delete FileVerify that thefile wasdeleted. Dothe sameprocess whenlooking for themalware file.Malware 101

Removal: Attempt to Delete FileAlso checkthat themalware fileis not in theprocess list.Malware 101

RemovalMalware 101

Removal: Clean up RemnantsMalware 101

Removal: Clean up RemnantsClick onStart- RunTypeREGEDITThen hitENTERClick on “My Computer”Click on Edit- Find/SearchIn the search box, type the name of themalware file then click on FindMalware 101

Removal: Clean up RemnantsMalware 101

Warning!Malware 101Do NOT delete registry entries that containsthe malware file name.Do NOT delete file names similar to that ofthe malware file name. It could havemimicked a system file name.Research about it first. If you think handlingthe malware is still difficult, send the file toyour favorite Antivirus vendor.

ehttps://twitter.com/gfilabsph

Trojan / Backdoor. Rootkit Malware 101. Malware 101 The famous “Love Bug” aka ”I love you” worm. Not a virus but a worm. (Filipino-made) Worms. Malware 101 Theories for self- . Rustock Rootkits Mobile Brief History of Malware. Malware 101 A malware installs itself