Saltar al contenido principal
CargarIdioma (ES)Atención al cliente
EmpresarialesMóvilRedes socialesMarketingTecnologíaArte y fotografíaEmpleoDiseñoEducaciónPresentaciones y charlas públicasGobierno y org. sin ánimo de lucroAtención sanitariaInternetDerechoLiderazgo y gestiónMotorIngenieríaSoftwareReclutamiento y RR. HH.Venta al por menorVentasServiciosCienciasPYMES y liderazgoAlimentaciónMedio ambienteEconomía y finanzasDatos y análisisRelaciones con inversoresDeportesMeditaciónNoticias y políticaViajesDesarrollo personalSector inmobiliarioEntretenimiento y humorSalud y medicinaDispositivos y hardwareEstilo de vida
Alex Matrosov, profile picture
Subido porAlex Matrosov
PDF, PPTX2,079 vistas

Carberp Evolution and BlackHole: Investigation Beyond the Event Horizon

This document presents an in-depth investigation of the Carberp cybercrime group, detailing its evolution, distribution schemes, and affiliations. It explores the technology behind Carberp, its impact on cybercrime, and insights into its operational structure and statistics regarding infections and attacks. The document also discusses potential future directions for investigation and highlights various cybercrime tactics associated with Carberp and related exploit kits.

Tecnología◦
Descargar como PDF, PPTX
Carberp Evolution and BlackHole: Investigation Beyond the Event Horizon Aleksandr Matrosov, ESET Eugene Rodionov, ESET Dmitry Volkov, Group-IB Vladimir Kropotov, TNK-BP
Agenda  Carberp cybercrime group investigation  evolution of botnet  tracking Carberp affiliate people  What are the next steps of investigation?  Evolution of Carberp distribution scheme  Carberp in-depth analysis  Domain shadow games  Infected legitimate web sites
Carberp cybercrime group investigation
Cybercrime group #1 Carberp ??? GizmoSB NeoSploit Carberp 1 BlackHole RDPdoor Shelldor Autoload
Cybercrime group #1 Carberp Freeq GizmoSB NeoSploit Carberp 1 BlackHole RDPdoor Shelldor Autoload
Cybercrime group #1 Carberp Freeq GizmoSB NeoSploit Carberp 1 BlackHole RDPdoor Shelldor Autoload
Win32/Sheldor C&C
Win32/RDPdoor C&C Carberp Freeq GizmoSB NeoSploit Carberp 1 BlackHole RDPdoor Shelldor Autoload
Autoload C&C
Arrest
Cybercrime group #2 Carberp Pasha aka ??? Qruiokd Klasvas GizmoSB «Who?» NeoSploit Carberp 1 Carberp 2 BlackHole RDPdoor Krys Sploit Sheldor Autoload
Cybercrime group #2
Cybercrime group #2
D****** I*** (10th June Arrested)  D****** I***, 1989, Russia – Botnet administrator («who?» aka benq-sim, also possible Sw1nDleR, Opsos)  Maxim Glotov, 1987, Russia – Malware developer («Robusto», aka «Den Adel», «Mobyart», «On1iner»)
Cybercrime group #3 Carberp Pasha aka ??? Qruiokd Klasvas GizmoSB «Who?» Hodprot NeoSploit Carberp 1 Carberp 2 BlackHole RDPdoor Krys Sploit Shelldor Autoload
Cybercrime group #3
Blackhole C&C
Blackhole C&C
Cybercrime group #3
Cybercrime group #3
Cybercrime group #3
Carberp & Facebook neauihfndcp8uihfedc.com (146.185.242.31)
Carberp & Facebook neauihfndcp8uihfedc.com (146.185.242.31)
Carberp 3 Sell video  Active sell – January 2011  C&C Video : http://www.sendspace.com/file/iquzl6 (BpgzsvrN)
Carberp 3 Sell video  Active sell – January 2011  C&C Video : http://www.sendspace.com/file/iquzl6 (BpgzsvrN)
Evolution drive by downloads: Carberp case
Exploit kits used in distribution scheme  Impact since 2010 (probivaites.in) • Java/Exploit.CVE-2010-0840 • Java/Exploit.CVE-2010-0842 • Java/TrojanDownloader.OpenConnection  Blackhole since 2011 (lifenews-sport.org) • JS/Exploit.JavaDepKit (CVE-2010-0886) • Java/Exploit.CVE-2011-3544 • Java/Exploit.CVE-2012-0507 • Java/Agent  Nuclear Pack since 2012 (nod32-matrosov-pideri.org) • Java/Exploit.CVE-2012-0507
Blackhole drive by download scheme legitimate site TRUE search FALSE vuln exploitation stage /getJavaInfo.jar dropper execution /content/obe.jar /w.php?f=17&e=2 /content/rino.jar
Blackhole drive by download scheme legitimate site TRUE search FALSE vuln exploitation stage /getJavaInfo.jar dropper execution /content/obe.jar /w.php?f=17&e=2 /content/rino.jar
Blackhole drive by download scheme legitimate site TRUE search FALSE vuln exploitation stage /getJavaInfo.jar dropper execution /content/obe.jar /w.php?f=17&e=2 /content/rino.jar
Blackhole drive by download scheme legitimate site TRUE search FALSE vuln exploitation stage /getJavaInfo.jar dropper execution /content/obe.jar /w.php?f=17&e=2 /content/rino.jar
Exploit kit migration reasons • most popular = most detected 1 • frequently leaked exploit kit 2 • most popular exploit kit for research • auto detections by AV-crawlers 3 • non-detection period is less than two hours
Blackhole migration to Nuclear Pack
Nuclear pack drive by download scheme legitimate site check real user TRUE search FALSE vuln exploitation stage dropper execution //images/274e0118278c38ab7f4ef5f98b71d9dc.jar /server_privileges.php?<gate_id>=<exp_id>
Nuclear pack drive by download scheme legitimate site check real user TRUE search FALSE vuln exploitation stage dropper execution //images/274e0118278c38ab7f4ef5f98b71d9dc.jar /server_privileges.php?<gate_id>=<exp_id>
Nuclear pack drive by download scheme legitimate site check real user TRUE search FALSE vuln exploitation stage dropper execution //images/274e0118278c38ab7f4ef5f98b71d9dc.jar /server_privileges.php?<gate_id>=<exp_id>
Nuclear pack drive by download scheme legitimate site check real user TRUE search FALSE vuln exploitation stage dropper execution //images/274e0118278c38ab7f4ef5f98b71d9dc.jar /server_privileges.php?<gate_id>=<exp_id>
Nuclear pack drive by download scheme legitimate site check real user TRUE search FALSE vuln exploitation stage dropper execution //images/274e0118278c38ab7f4ef5f98b71d9dc.jar /server_privileges.php?<gate_id>=<exp_id>
Nuclear pack drive by download scheme legitimate site check real user TRUE search FALSE vuln exploitation stage dropper execution //images/274e0118278c38ab7f4ef5f98b71d9dc.jar /server_privileges.php?<gate_id>=<exp_id>
Carberp detection statistics
Carberp detection statistics by country Cloud data from Live Grid Russia Ukraine Belarus Kazakhstan Turkey United Kingdom Spain United States Italy Rest of the world
Carberp detections over time in Russia Cloud data from Live Grid 0.18 0.16 0.14 0.12 0.1 0.08 0.06 0.04 0.02 0
Evolution of Carberp modifications
Different groups, different bots, different C&C’s Gizmo D****** Hodprot
functionality Gizmo D****** Hodprot Dedicated dropper   Win32/Hodprot Java patcher    Bootkit    based on Rovnix RDP backconnect  Win32/RDPdoor Win32/RDPdoor TV backconnect Win32/Sheldor Win32/Sheldor Win32/Sheldor HTML injections IE, Firefox, Opera IE, Firefox, Opera, IE, Firefox, Opera, Chrome Chrome Autoloads    Unique plugins minav.plug sbtest.plug sber.plug passw.plug cyberplat.plug ddos.plug killav.plug
commands Gizmo D****** Hodprot Description ddos    download DDoS plugin and start attack updatehosts    modify hosts file on infected system alert    show message box on infected system update    download new version of Carberp updateconfig    download new version of config file download    download and execute PE-file loaddll    download plugin and load into memory bootkit    download and install bootkit grabber    grab HTML form data and send to C&C killos    modify boot code and delete system files killuser    delete user Windows account killbot    delete all files and registry keys updatepatch    download and modify java runtime deletepatch    delete java runtime modifications
The Story of BK-LOADER from Rovnix.A to Carberp
Interesting Carberp sample (October 2011)
Interesting Carberp sample (October 2011)
Interesting strings inside Carberp with bootkit
Carberp bootkit functionality Inject user-mode payload Bootkit Load unsigned bootstrap code driver injector
Carberp bootkit functionality Inject user-mode payload Bootkit Load unsigned bootstrap code driver injector
Carberp bootkit functionality Inject user-mode payload Bootkit Load unsigned bootstrap code driver injector
Callgraph of bootkit installation routine
Rovnix kit hidden file systems comparison functionality Rovnix.A Carberp with bootkit Rovnix.B VBR modification    polymorphic VBR    Malware driver    storage Driver encryption custom custom custom algorithm (ROR + XOR) (ROR + XOR) (ROR + XOR) Hidden file system  FAT16 FAT16 modification modification File system  RC6 RC6 encryption algorithm modification modification
Comparison of Carberp file system with Rovnix.B
Comparison of Carberp file system with Rovnix.B
AntiRE tricks
Removing AV hooks before installation
Calling WinAPI functions by hash
Plugin encryption algorithm
Communication protocol encryption algorithm
Banks attacking algorithms
Bank attacking algorithm Gizmo D****** Hodprot HTML injections    autoload 2010  2011 (Sep) dedicated plugins for major banks    intercepting client-banks activity    patching java    webmoney/cyberplat    stealing money from private persons   
Statistics of real attacks with Carberp
How we get statistics o Large guest network segments and wired Internet access monitored by IDS o Attack attempts on corporate PCs o Attack reproduction to collect exploit and payload samples o Targeted infections of dedicated hosts for activity monitoring
Carberp C&C location Date Domain name IP-Address 02/Apr/2012 mn9gf8weoiludjc90ufo.org 62.122.79.3 03/Apr/2012 mw8f0ieohcjs9n498feuij.org 62.122.79.4 03/Apr/2012 nrf98uehiojsd9jfe.org 62.122.79.3 20/Apr/2012 mn9gf8weoiludjc90ufo.org 62.122.79.9 23/Apr/2012 mn9gf8weoiludjc90ufo.org 62.122.79.72 23/Apr/2012 newf7s9uhdf7ewuhfeh.org 62.122.79.11 23/Apr/2012: ne789gfiujdf98ewyfuhef.org 62.122.79.46 23/Apr/2012 supermegasoftenwe.com 62.122.79.59 02/May/2012 rgn7er8yafh89cehuighv.org 91.228.134.210
Hacked web servers stats Q4 2011 - Q2 2012 Domain Resource type Infection period Times seen Unique hosts ria.ru news 02.11.11 – 01.03.12 10 527064 kp.ru news 04.10.11 – 13.10.11 10 427534 gazeta.ru news 24 Feb 2012 1 380459 newsru.com news 05 Mar 2012 1 321314 lifenews.ru news 26 Mar 2012 1 183984 pravda.ru news 20 Apr 2012 1 164271 eg.ru news 08.10.11 – 13.10.11 6 137332 topnews.ru news 06 Feb 2012 1 139003 infox.ru news 05 Mar 2012 1 137396 rzd.ru National Railroad 13.10.11-24.10.11 12 131578 inosmi.ru news 02.11.2011 -15.02.12 5 113374
Top targeted auditory Domains Domain Resource type Infection period Times seen Unique hosts klerk.ru accountants 20.04.12 - 03.05.12 3 147518 banki.ru finance 24 Feb 2012 1 67804 glavbukh.ru accountants 06.02.12 – 03.05.12 4 43606 tks.ru finance 01.02.12 - 03.05.12 3 23067 bankir.ru finance 24.01.12 - 11.05.12 2 44542
References  Exploit Kit plays with smart redirection http://blog.eset.com/2012/04/05/blackhole-exploit-kit-plays-with-smart-redirection  Facebook Fakebook: New Trends in Carberp Activity http://blog.eset.com/2012/01/26/facebook-fakebook-new-trends-in-carberp-activity  Blackhole, CVE-2012-0507 and Carberp http://blog.eset.com/2012/03/30/blackhole-cve-2012-0507-and-carberp  Evolution of Win32Carberp: going deeper http://blog.eset.com/2011/11/21/evolution-of-win32carberp-going-deeper  Rovnix Reloaded: new step of evolution http://blog.eset.com/2012/02/22/rovnix-reloaded-new-step-of-evolution  Hodprot: Hot to Bot http://go.eset.com/us/resources/white-papers/Hodprot-Report.pdf  Cybercrime in Russia: Trends and issues http://go.eset.com/us/resources/white-papers/CARO_2011.pdf
Thank you for your attention! Aleksandr Matrosov Eugene Rodionov Dmitry Volkov matrosov@eset.sk rodionov@eset.sk volkov@group-ib.ru @matrosov @vxradius @groupib Vladimir Kropotov vbkropotov@tnk-bp.com @vbkropotov