Totally Spies!

Video in TIB AV-Portal: Totally Spies!

Formal Metadata

Totally Spies!
A Tour in Espionage Cartoons
Title of Series
Part Number
Number of Parts
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Release Date

Content Metadata

Subject Area
For some months now, there were rumors of cartoon-named malware employed in espionage operations. It actually started in March 2014 with a set of slides leaked from the Communications Security Establishment Canada (CSEC) -- Canada equivalent of NSA. CSEC then described to its spook friends a malware dubbed Babar by its authors, which they attributed "with moderate certainty" to a French intelligence agency. The group behind Babar is now commonly referred as "AnimalFarm" in antimalware industry, because Babar was only a small piece of a much bigger puzzle. Since CSEC slides' publication, a group of valorous adventurers, animated by the thrill of understanding complex malware operations, has been relentlessly following AnimalFarm's trail. Along its path, this group found several pieces of AnimalFarm's arsenal, for example stealthy Casper, exotic Bunny and even big ears Babar itself. This presentation aims at presenting the results of this group's research. In particular, we will provide a global picture on AnimalFarm's operations, and also delve into technical quirks of their malware. We will also explain how we assessed the connection between their various piece of software from a code reverse-engineering perspective, and what are the technical hints we found regarding attribution.
Multiplication sign Website Right angle Extension (kinesiology) Table (information)
Slide rule Trail Computer animation Information Presentation of a group Operator (mathematics) Group theory Mereology Descriptive statistics
Software developer Operator (mathematics) Group theory
Complex (psychology) Group action Pixel Context awareness Parsing Thread (computing) Interior (topology) Code Java applet Multiplication sign 1 (number) Parameter (computer programming) Mereology Food energy Neuroinformatik Subset Medical imaging Emulator Mechanism design Mathematics Hooking Strategy game Different (Kate Ryan album) Single-precision floating-point format File system Endliche Modelltheorie Physical system Area Scripting language Injektivität Boss Corporation Enterprise architecture Block (periodic table) Binary code Data storage device Parallel port Hand fan Electronic signature Degree (graph theory) Sparse matrix Process (computing) Hash function Order (biology) MiniDisc Normal (geometry) Quicksort Arithmetic progression Fundamental theorem of algebra Row (database) Point (geometry) Windows Registry Functional (mathematics) Server (computing) Service (economics) Computer file Robot Virtual machine Similarity (geometry) Drop (liquid) Event horizon Coprocessor Theory Number Revision control Latent heat Causality Term (mathematics) String (computer science) Data structure Traffic reporting Tunis Plug-in (computing) Condition number Task (computing) Module (mathematics) Dependent and independent variables Key (cryptography) Projective plane Physical law Interactive television Mathematical analysis Line (geometry) Directory service System call Integrated development environment Personal digital assistant Video game Object (grammar) Family Computer worm
Backup Information Personal digital assistant Virtual machine Video game Instance (computer science) Quicksort Measurement Element (mathematics)
Slide rule Functional (mathematics) Backup Context awareness Group action Hoax Run time (program lifecycle phase) Sheaf (mathematics) Distance Number Revision control Latent heat Term (mathematics) Semiconductor memory Thermal fluctuations Measurable function Energy level Software testing Metropolitan area network Form (programming) Information Digitizing Projective plane Expert system Sound effect Total S.A. Set (mathematics) Instance (computer science) Mountain pass Cartesian coordinate system System call Measurement Message passing Arithmetic mean Process (computing) Computer animation Telecommunication Order (biology) Universe (mathematics) Triangle output Configuration space Video game Quicksort Object (grammar) Window Library (computing)
Group action Run time (program lifecycle phase) Set (mathematics) Parameter (computer programming) Dimensional analysis Coefficient of determination Sign (mathematics) Strategy game Hypermedia Semiconductor memory Software developer Binary code Data storage device Electronic mailing list Sound effect Bit Degree (graph theory) Proof theory Walther-Meissner-Institut für Tieftemperaturforschung Process (computing) Website output Quantum Configuration space Summierbarkeit Right angle Figurate number Resultant Point (geometry) Server (computing) Functional (mathematics) Beat (acoustics) Computer file Virtual machine Field (computer science) Machine vision Product (business) Revision control Latent heat Operator (mathematics) Proxy server Address space Matching (graph theory) Information Mathematical analysis Line (geometry) Vector potential Antivirus software Computer animation Personal digital assistant Table (information) Window Computer worm
Server (computing) Computer file State of matter Virtual machine Set (mathematics) Latent heat Operator (mathematics) Core dump Modul <Datentyp> Endliche Modelltheorie Extension (kinesiology) Traffic reporting Computer architecture Module (mathematics) Noise (electronics) Information Software developer Binary code Sampling (statistics) Expert system Data storage device Variable (mathematics) Dean number Message passing Computer animation Configuration space Surjective function
Module (mathematics) Functional (mathematics) Graph (mathematics) Mapping Key (cryptography) Software developer Content (media) Data storage device Letterpress printing Line (geometry) Function (mathematics) Particle system Type theory Computer animation String (computer science) Core dump Website Configuration space Data structure Resultant
Functional (mathematics) Link (knot theory) Computer file Length Set (mathematics) Field (computer science) Number Revision control Semiconductor memory File system Software testing Endliche Modelltheorie Data structure Condition number Area Module (mathematics) Dialect Key (cryptography) File format Data storage device Electronic mailing list Content (media) Sampling (statistics) Type theory Subject indexing Pointer (computer programming) Process (computing) Computer animation Order (biology) Speech synthesis Configuration space HTTP cookie Object (grammar) Freeware Reverse engineering
Predictability Point (geometry) Greatest element Matching (graph theory) Key (cryptography) Code Tape drive Electronic mailing list Set (mathematics) Flow separation Semiconductor memory Operator (mathematics) File system Configuration space Error message
Point (geometry) Predictability Area Dependent and independent variables Link (knot theory) Code Block (periodic table) View (database) Software developer Electronic mailing list Set (mathematics) Field (computer science) Mathematics Computer animation Semiconductor memory File system Data structure Freeware Error message Address space Physical system
Functional (mathematics) Implementation Computer file Length Workstation <Musikinstrument> Characteristic polynomial Virtual machine Similarity (geometry) Group theory Mathematics Different (Kate Ryan album) Semiconductor memory Internetworking Data structure Endliche Modelltheorie Physical system Adhesion Predictability Algorithm Logarithm Electric generator Software developer Content (media) Electronic mailing list Sound effect Maxima and minima Arithmetic mean Process (computing) Computer animation Integrated development environment Personal digital assistant Clique problem Asymptotic analysis Library (computing)
Point (geometry) Slide rule Link (knot theory) Image resolution Multiplication sign Similarity (geometry) Theory Number Medical imaging Root String (computer science) Ideal (ethics) Software testing Physical system Information Key (cryptography) Software developer Forcing (mathematics) Projective plane Electronic mailing list Staff (military) Database Flow separation Proof theory Computer animation Right angle Quicksort
Area Windows Registry Software developer Multiplication sign Binary code Sampling (statistics) Interactive television Residual (numerical analysis) Type theory Personal digital assistant String (computer science) Configuration space Endliche Modelltheorie
Slide rule Beat (acoustics) Shift operator Information Link (knot theory) State of matter Software developer Sampling (statistics) Group theory Directory service Flow separation Attribute grammar Computer animation Different (Kate Ryan album) Personal digital assistant Routing
Point (geometry) Installation art Area Slide rule Boss Corporation Server (computing) Musical ensemble Graph (mathematics) Information Software developer Binary code Mereology Public key certificate Web 2.0 Supersymmetry Uniform resource locator Process (computing) Computer animation Term (mathematics) Network topology Universe (mathematics) Website Collision Physical system
Point (geometry) Existence Mapping Software developer Sound effect Parameter (computer programming) Event horizon Compiler Uniform resource locator Mathematics Message passing Forest Programmable read-only memory Website Traffic reporting Library (computing) Condition number
Point (geometry) Slide rule Group action Computer animation Information Personal digital assistant Different (Kate Ryan album) Decision theory Charge carrier Integer Attribute grammar Condition number
Slide rule Computer animation Information Self-organization Right angle
the who were asked to wear a lot of you if you if you think the the the a half half a everyone morning thing for being here and my name is wrong way and my researcher working at the set and and here on stage with we bullets in right in the table the 1 at time of researcher orchidectomy German launches company and then when his name Poznan pink because a like pink on another extension had site for it which is US company and I'm working there is a threat researchers and their and you're on topic spice yeah so it's all story uh basically
started a few months ago what we last year uh because of this you may have
already seen this slide and it's part of a presentation that was leaked by it was modern involving 14 it was 1st mentioned by the French newspaper Le Monde uh in much falls in 14 and so basically as you can see the slides were made by the Communications Security Establishment of Canada this is Vasicek which is the NSA in Canada basically and so may describe on this slide what we call the operations no and that's the because the description of the will actors but they have seen in the wide and I they have tried to to track basically so they describe the group and 1 of the striking information inside the slides it is on the slide where they basically SS with moderate 70 but these operations below has been put forth by a French intelligence agency and that provide very few technical details but there are a few of them and that's on the slide basically
whereby describe 1 malware used by the group beyond operations Nobel as which is called by the developers apparently by that and they also have to develop username probably from the past s but basically where we decided to let and
making the the the but the of so much of many of you know this this picture picture these 3 girls that's very I think a children's cartoons mentally spice is a free Spice him and these are these are of our characters to they telling you about that always placed Muller and and this was not my idea this was Paul again I just just mention that because again the 1 of the 3 of us little children I'm very right and begin so how the the
hunting of like as you know every every get positive but they became known as the time when the brandy that's most important thing about nor there is a of our time and discovery and with initially a different families we found in the time on the timeline is when they were about like created or when we believe that they were compiled and put the order in which appears to in which we found them so the 1st thing we uncovered was and bought or tissue into the urine of a short article Noah and conditional strengthening and but it's the houses spots which are quite simple and were compiled about thousand 10 which were not interesting at all but they let us on to find the funny molar which was a lot more interesting which was probably composed 2011 or which you know the will spread in 2011 and the next thing from the binding money was by far the US we encourage of art and French meals really really happy about our having someone speak about nor that the war lasting fans after the body worker tunes popping up and we imagine Ankara Caspar casbah is mechanisms Norris was spread in serial interesting through what in 2014 and make the parcel thing but the newest our atom character that we found was deal which was spread on same time in the same area so they wouldn't presented well all these different characters right as a sort of how we how do we get onto the smaller the 1st thing we had as emissions and what you see is light and on very sorry that and I approve screenshot on his life of stores versions of this that we can but I still get to that just show you how simple the itself of was so obviously answer like flooding all sorts of things that the strings clear in there so we have denounced response which comes pretty clear text so let me think a plane binary uncoded unpacked it hasn't come from from the interior since I started off as a journalist and antitrust company and I would have been about the very excited to see such a about because the complexity just or that was like if you if you travel pop not and the you use right your boss you might want to prevent someone from detecting all your bots with wanting signature just an idea so this is quite interesting but was more interesting this with the sports I had so of was singled expressly and is based on on the singles that provide images were should right if you have any questions about why this specific men's singles out Iran's running around and so I had a where you might think in my and I wasn't surprised when within the next 20 minutes ago an answer from the team like all this is interesting that you have this on 100 surely is but could you tell me where the from which computer was infected to on the computer which company was a computer and and how did you get answers aspiring not like so this issue so and this is the 1st impression and after a while asking around about what is discussed about the fundamental argument and time to look at something else like that were on the binaries with like similar structures in the and using similar techniques being quite different so this was the 1st step toward the next part of which was
done by me so as to payment mom from the dropper which came that PDB string that telling a project named Bunny 2 . 3 . 2 and I know not not specifically if anybody's but that's that's great you aren't so these are binary funded ranges similar from the further she based the hashes of the spies and found out there are there already mentioned line on the block which documents a spear phishing complain that happened in 2011 so I want to ask that block writer like how did you get these binaries and what kind of spearfishing was and how that work and you read in the Union's of foreign why didn't you it say any details about the spearfishing event but what he said was I had these priorities I haven't looked at them closer but was told us French governments bring them like a well OK this is even more efficient on so this is the 1st heard of the French government anyway was playing so funny is a scriptable bought but incorporates a lower energy and can download an executable script to execute with the engine and instruments that seek the sparse codes of the binary and I'm sure you have is spilled the money is being the model that is made from which is busy with common parting from Caesar and execution of scripts these scripts will be loaded from different text files which are placed on disk so the command parsing the nothing like parse 1 file after the local description and execute indicated threats so the answer but was out to execute most of these scripts these muskrats would be dumped into a text file by different here that's this mountain biking on whether this is a term which is defined in the wineries the binary causes worker threads this here some of these here that's here is 0 is 1 that doesn't uh actually a downloads and and stunned scripts that was not too sure what the purpose of user with the DFA are busy with fashion scripts once I HTTP like playing world of of scripts uh here 3 would have no scripts from the file which is downloaded from it pieces and here to interest me with place contrasts to configure tasks to be scheduled at a specific point in time also the conference services for me that was uh defined by the binary offers theory so this is basically the workflow lot steps next injecting legend at the same time of the commands resistance in the and and the actions of others take with them to text this pixel was matched by any of the spherical because out again the mother president performs wanted to keep a execution of of I was about our with the reference so there's there's some theories like blue those originally signed for computer games with can inject here into a computer game like that the bombs explode let things happen all of a sudden unexpectedly another context so my 1st here is that the spot and download the steps to instruments on cold could in inject behavior through text files into the into the binary so what 1 would do is not download other binaries to as plug-ins to execute behavior but of Lewis grants to instruments on code and changes behavior on the fly now the interesting thing is that but only Lewis scripts are not actually downloading binaries so you have to execute binaries disk assumed to create a new thread every time you want to inject behavior vicious only down the plain text file this is rather small and doesn't doesn't get tension and is still injecting behavior you want to get married so that was pretty smart was is interesting about our money was was pretty are like a con sidered Robert armouring it wasn't really are the came interesting in Genesis checks was interesting for me is that it had a long term which is rather uncommon for the usually begin the I see anyway altogether therapies simple and just kind and answered the than and either check the check the module path of objects to the model if it contains strings indicating an emulator I think Paul is explain this in more detail later on it would take the director name from which it was executed to see that was the directory the droplet critically see the payload was really dropped by legitimate dropper this might seem simple but it works most sandboxes to evade execution but it changes the times that of the parallel to the system installation at it would check if the number of processors is with 15 which is not the case if you run and and simple community environment like for example in enterprise engine and the later it will check if any roped which happens if you turn on like norm within the and hook the get to come together but it will obfuscate a subset of a place so that the low the subset they place dynamically indicated by Hessian by interestingly this hashing functions resemble is regrettable and is shared throughout most of the of the current law and so as a poll who can't speak about this later again but well as smart is that they don't look all the the DAPI semantically but only the ones that indicate found here so EPA for interaction the register you a case for interaction the file system for all of the skin so I think this was for the invasion off our analysis which is I'm looking at the invertible to pre simple trick but might be effective in some cases so the thing was infections you this evening yeah can the infection strategy on which a check which antiresonance from the machine and then decide on a specific technique will want to inject an already existing process of creating new process and check the of them are over and which requires love knowledge of how dangerous or the acute and rows engines I work and what kind of infection stages they watch out for that's 1 of these which are essential for the progress our future was envisioned check for sandboxes where the final payload would not be loaded with other report of to machine because the drop relaxed and functionality to invoke the payload as discussed as a lot of people it's it's pretty effective against a sandbox because during the degree of automation as yeah persistence mechanism was was for registers of was a registry key which invoke the money but the thing is the bunny dropper would not delete itself after John Taylor the binder executed the place the the payload with greater register key and then nothing will happen and on top of the user report the machine then the payload would be invoked as a registry key and delete the Java server I'm not sure of if this was like intention or if they just forgot to invoke the pillow the and this is the bunny some of the bunny like really excited this call I but and we found out that there was something else that have been have been documented in the array there was a lot like Bonnie the bar the guy in the US said there's like any more names and the mom and with I OK with to be searching for the body if I hear a refund of
our and another was familiar with the bar as a French cartoon characters an elephant and
as the 1st measure element in cannot in 2014 where they're speaking about the mission's Snowden's life so there's sort about the bar I I personally call my pet my assistant of and that bar is an askin much lower at this looking it's deals screenshot so idea captions like everything a good spinach should be going and this is by far the invading the winners machine so let let me tie in advance was not like a really sophisticated knowledge but the does is shot very well so the bar would work for a local incense and to chart instances as a backup no KPI and what processes still data which would entities appears in the flight and exited this information to its users over let's have a
look at prepare the beautiful slide and laying at the operation so that the bar below that as of the bars and you know she's loaded up through a register Q which invokes erectus to it's a but then inject itself to uh process Ryan investor which is randomly chosen which the main stands which will then go on to infect to chances are it is this as backup only serve the main instance in an infected poses by sequential takes over in its neutral to guarantee persistence so this means that would take over most of the functionality of the looking at what still there from the clipboard of steel names of running processes of names of this the winners of the open nothing very exciting but what those do was as mentioned look into other the processes so the means test would load it's itself of the allow into other processes through co-winner when suck and our own atom to the message showing off the running application to be able to have to it's in my hooking so the process of interest were identified for the configuration so if for example Microsoft Word was opened the triangular would take action and placing a hoax on dedicated because those interested in the EPA looking was performed by the markers of the terms Larry so I'm I'm rather young precision and I haven't heard of it before but other people were laughing at me because it serves as like in 1999 but so yeah our our alters our was studied so as I mentioned works well let's have a closer look at how that works so 1st of all level interesting was the process invasion that were performed with low COL mentioned and uh injected into running processes which are to section object to deliver information to the child and to the effectiveness and the thing that pipename number of instances and the exponentially cult it will then uh allocate memory in the sort of processing copies the function that which was used to create a remote process which are then load the the body called indicated exponential but this technique in the other what happily in context of the fact opposes but this technique the are could invoke any of its experts which is suggesting still out of the process and then calling any the ex-president and thus calling the dative functionalities this is for example how the CNC collocations performed this user can communication is look at in in 1 specific expert so if the bar would want to communicate its use is our oceans carried chances with with a call to this since the functionality hand over the data we should be communicated and then run the deal in context of another process the 2nd thing about was interesting because the simple security so that you above are used was like the most uh simplicity longer 1 Clinton and create an invisible message on the window which prevents measure the message dispatching creator or input device which is then used to filter for input when the messages of the specific settings here on the slide on it would think of digital input data to receive the input your eyes I captured when just translated version of 2 a characterized so far this is probably the most simple cubic could write again find this document on a cold project article which is titled so something yes and simplistic universe simple cure so congratulations for others the thing I and lasting measurements astray was the whole of our hiding has in place I interested in being seen the which is yeah they user with his functionally were actually the the man his landed get lower what is the name from the our hooks targets functions of books function calls to specific target functions which are adjacent Kazan with this through the detours library but literally use caution that these as leverage to place in and hard is performed so so the bar would override the target function the 1st of target function to point to a detours function which will perform the measures functionality so in the data function would either still data which was going into an API is still there which was returned from an API In order to them before the last was called the legitimate API to hide the Hawking and to deliver the Edgerton value to the calling process so this was function the of uh the execution for which onto the dysfunction forms functionality Our and then the back to trampoline function which contains the overwritten bites from the target function so trampoline function would make sure that the function call the final function call could happen after all within hand or execution to the rest of the target function which of the return to the dysfunction and from there back to the caller so I'm sure this was silent stating data at runtime from process with other imposes an noticing it this is called a hope but why would do this for in the communication fluctuations on distance this for the specific in place it would look after all the bar is a total does shoppers so this is
just and as we publish about the bar people coming assets gear things like is it anything they like Reagan is getting really really sophisticated and I was dying when I saw quotes from Paul when he told people that Reagan ants and compared to keep in mind that the show enough for the day to day life and
just the reason to be in full information of the french media called of the not went we could be still papers and the 1st question of or journalist is that colony was that French government 1st mission and the 2nd question I don't really know why but ordered release ask me if it's a more complex on less complex and Fijian and art of John sums of French newspaper of make some joke about potential friendship repel cos it's list if larger than vision so that's why I write this these OK so the next 1 we found Gasperin so as Miles said that an and like other inventing Caspar is simply clinicians to the 1st stage matter where for the group and among the sum but we got there is a DLL whether burst for but to remove the origin of name a from the export table the it has been developed in C + + like most of the animal from where and that it has been deployed at least in April 2014 on a few people in Syria thanks to a fuzzy zero-day they exploit and interestingly the exploit the Kuspa binaries it's since the server where all all said on 1 machine in Syria but belong to within justice ministry but we believe the animal farm at the world beyond that which is called I'm a firm as you may know um simply actually website leaders storage the the as so the 1st thing that desperate dies when you rise in the machine um it's degree it's figuration 5 which is an exam 5 and condensin but at instructions on how to deal with anti-virus software but could be running the dimension and they create a strategy and base you can see here that the other is a strategy that defines the before strategy and inside the strategy that there are some AV dogs defining strategy for specific anti-virus software and that's so at runtime Caspar checks which anti-virus run on the matching and applies the corresponding strategy over the 4th 1 and so what the strategy it's basically is the set of parameters that define Eva alter their from certain actions on the dimension all were certain action should be performed so for example the although that parameter that defines our because that Lopez we remove itself from the machine after having broke the field and then you you see here that for for the defender of the other that parameter is set to API which means this action will be made proof that go to the Windows API function more find x w to esterified to be deleted at the next stop there but if you run a last anti-virus in this case the same parameter is set to WMI which means the same action would be performed differently and in this case it would be true for uh command line but would be decrypted and then executed into a new process the command line is just to look flat tries to remove the proper and deep what's in the new process it's great that true for in my request the so that means that the Gospel developers have an in-depth understanding on how each antivirus product money dimension and they implemented bypass for each 1 of them and for each noisy action but does for us to do which is benefit of the the of the 4
the next thing that does it receives some comments inside the configuration file and in particular I very easy Instead command to drop the payload and make it persistence and persistent and we mention that 2 versions of the bill provided uh 1 4 4 2 beat smashing in the x 56 tag and 1 for 64 bits smashing an interesting detail here I would like to insist on is that the best but low-power gives an input parameter to appeal and this input parameter has to have the exact specific value have focused but they don't run normally and a way to implement pretty deceptive it's not a simple check at the beginning of the execution of a payload uh no it's done in this function in the press the payload it's basically the function in charge of finding the API address that in memory so it's a get broke address basically but they don't use the name of it yeah the use of ash fall bytes ash and collected from the name and interestingly the 1st and the 1st thing that this function does is absorbed between 4 bytes of that constant the viable I Nunchuk some and the ash given in input to a function that's true for and whether the checksum some come from it's the result of a few eremitic operations done on the input parameter of Caspar binary so let's say the checksum is not the quantum yet but it and then the bags or will not be equal to 0 and to look for defining this line would not be but to ask given in input to a function which is the correct asked to look for so in this case is get book at West we not retrieve the correct API function because it does not look for the correct ash because he didn't provided the right input value to guess a payload such that a chick some users want to be up the cost so we have to provide a despot this exact value such that you ladies economic and if you don't do it you will get a random graph because at some point it can be the and the yet was retrieved and it's not the great that isomers we crash inside and Windows API so let's take me to make the analysis of the payload without having the proper difficult because you have to find this exact good value such that the sign will have no effect yeah so once
specific need no money on the machine and it is very the dead reports on the machine and you can send extract here and this report is sent back to the server which can provide in answer XML file once again containing commands and in particular they can deploy seven-stage binary at the state and we don't have any civil stage binary uh because the since he was down uh when we start investigating and Gaspar so let's a forecaster the
n now it's sent to talk about the you know um but so solving over 1st I'm at the noise but you commanded so Dean all
is more in the category of of our inborn it's Aniston as bad or a civil state my where as does a lot of features an intruding has the ability to do some complex by search request that you pray Tuscan after they do no matter where the the all 5 beefed-up extension was with run a certain amount of bytes where m where modified in the last few days and that's where the the end goal of general exceed exhibiting information from the target we got only 1 sample of being elected and the December was deployed in Iran in 2014 and it is developed in C + + with a king modular architecture and no entity I inside a binary but there are a lot of variables there are messages like this 1 for example and once again they forgot to remove the origin of finding from the expert David so obviously stuff modules that we got in our sample with the names given by the developers and so far as there is a PSM module on which set which maintains an on this copy of all the models of the then the core module contains the configuration the content modules and allows the operators To skidoo dust and with the syntax that is almost exactly the same as the con the UNIX command and then there is the f and g on modular to upload and download files onto machine whereas the they sending the you are managing the execution of commands and you know and finally they got the module but because of our at that store the no specific endowment by others yeah so now I'm going to be but the thinking into technical details in the l
so 1 of the important thing when analyzing the no uh was to understand because some data structure but the used everywhere basically and in particular to store the content of the modules of you know the developer called district a data store and but so that's a map from strings to values these values graph can have a placebo diets some of the sites of a fixed size like by trolled wall as the most types of viable sites and the type names here uh they also come from the developers because in the you know there is a function at to print at a store nicely and they ate it brings in particle of a name of the types and so for example it is the result of printing the
that already inside the core module and it contains the configuration of you know so that's really the output of the print function that is inside know so you can see on its line the key if there the value associated with the key and the type of this value so obvious that us to implement that actually um as I said it's a much
and they are adamant that it's like a simple are so in memory in a test or objects the 1st field is a pointer to an array of entries and then each entry starts the linked list containing key value pairs so in order to assist with the there is the ash function that is used to actually you get a number a bigger number model for it gets the it gives you the index in the area where the link list was to become the new york he as starts so for example in this simplified have you know the ash of a key I P is free model for civilian police containing the TIP starts at the index free they fix the number of buckets to form but if the size of the IRI to 4 uh which makes is that the structural not really efficient because the out of regions a lot of key with the same index in the area and the link this rover really fast another thing to know about that the story is that they can be cialised and they have some custom format to stabilize the data store and it looks like this a sailor that the store it begins with a magic the world the x as x in begin down then a suspected version number than the number of start items and then the cialised items themselves 1st keep its length its name and yet the value of its type and the value at the same that I saw I use in particular in the piston will you that maintains the today cookie of all the content of the modules and it is done inside an anchored at 5 and this is by the way the various 4 key they used to include the file so we can my work speech over the reverse and so yeah that's it for that a storm an interesting thing is also inside you
know is a module but they're scholar from a face it's also presenting over and from binaries and like the name implies um they just complement at a store I think that the story a custom data structure but if you organize it by the way I just I would be very happy to know so manifest and like I said it's like the name implies it's a temporary file system that can be mounted in memory from unencrypted blow but is initially inside the configuration so once it's mounted in memory of manifest we remain stalled always the encrypted chance of data so it's a set of fun conditions of data and the chance would be decreed that only on demand and in this in our the sample 1 if this initially contain 1 5 uh that they're a process called the king of fight and it contains instructions on how to remove the moat from the mansion so to give you an idea there is the
code that is responsible at to execute the king of 5 so when did the operator also want to remove the moat from the match so the 1st thing he does is to look for the name of the king of 5 which is inside the configuration and you can see at the bottom but once again they provide very there there on the stage so we know basically what's the purpose of a check from the error message so if they found the name of the king and the configuration and then they look for the cryptographic key to dicrete run if this initial blood in configuration and you can't see that the code is the the pass-phrase so that they are reading the file system and mind-set and then if it works there is yet another month operation operation which is basically creating a separate subject in memory but contains the file system and a Vermont works and then that is a good picking a fight which is inside benefits so always run a physically implemented at that lower than
and so in memory we got this 1 if the subject and as I said on if this is a set of and predictions and this chances are inside and linked lists for which we go out at point a and a tape on the inside that is the subject of your 78 so added that they pointer
points to the beginning and the end of this link list and each it that I 10 of this list is actually Oman address of a change in there um Bijankhan there is a structure containing in the 1st feel the less of a chance and in the 2nd view the key but serve to increase and decrease the change so it's champ and could be vertically and the dead with a different key and and basic and finally the um which and condemned at response to a 5 and wrote 12 bytes of uncoded data so that's the way promises looks like in memory of a set of fun predictions that you can access from an increased this is not even the 5 system structure but after 5 system structure inside the
1st chance so they would the structure the the 1st chance when the mother of the file system and stop the structure inside the beginning of if subject this is the only path that stay always decrypted in memory so the rest of us is then is always and dead and cadet that on demand and the interestingly we got the name given by the developers for free fields in this structure because also about it because of some error stage in the code so we know that the broke all these 3 fields here the fight is before each and block list and if we fight it areas the finalists is the only 1 that is non empty at the beginning and like the name implies it's at least at
all the files stored in ROM effects and in this case we only got 1 5 but you know I just spoke about so we got the name in the structure of a the mean and the content of a fight the content is a custom command to understand you know from the machine thanks to a Dutch you at so basically manifest also come with a custom command under and here are a few comments that they can execute inside manifests itself Command I just show you the Extract command of fighting to run a face and put it on to the reference system at 2 commands to execute or inject 5 five-story to run affairs and a command to keep a running process and to the mansion so we can guess that this 1 if this thing is really a disposable execution environment for the developers it's always the and dead is 40 out demo for and seek to understand the structure so but for the purpose and my question is if this thing gets on be they could be pasted from somewhere or not I couldn't find any implementation like you like that on the internet uh so I tend to believe it is discussed on in particular because of the size of the characteristics of the finance in FIcontent are the maximum violin length when with 60 characters and the UN and predictions once they but they could that the change they are manipulated as chance of 540 bites the stuff which is not so common as far as I know and I couldn't find any annotated down 5 so they don't seem to have any stamp of desperation as litigation by more things like that so I believe benefits discussed them but once again if you organize this thing and I will get it on NO so we spoke about a lot of different model asymptotics try and I know I'm going to try to explain to different cliques we form the between H of Z and similarity and why we think it's so as the same all more is the same as a group of developers behind Russell system 1st things uh the mentioned is it a PA station so basically every customs and use the same techniques to obfuscate to air at TI z other role deserve library in this example committed to the DNN in memory and the takes a list of export fiction and generate ash of each exported function through 5 so but wanted sh so we found 2 different algorithms she
argues for example is a logarithm used by billion cast so it's a it's really easy to create a holiday and exhaust the 0 I put by transcriptome adhesion and example and also partial of create processes function so each other the other
a similarity between that somebody is aware of on jurisdiction on the each customs the z developers used the my Paul I find it URIs instead of the system so the user roots occur isn't over that 2 on the New York of with the system make a set it up select staff all from on jurors project to get the on various name and a institution that text lecture and infects the use of the use of 1st the name of this secured to predict for example and if you look good you that that it's own is a g and that g that that it's so it only takes a 1st World and a make of Charlotte and the 1st all the shot inside the binary and check if it instead on duration is this I just for information is a free there shot we didn't find which i'll jurists is detected we don't find the name so if by any chance you have an ideal of a huge database of maybe you could help has to how free list of the detection so this is not
a said things about accountants and there is uh certainly don't addiction so if you look at something are if n is the last 1 he should be a f flying exterior so it's uh run the name Gerrit generated by caspase t Kaspersky put but to develop I got it so wrong than they need send a binary so I think you make a test has its name and of just name and didn't take a 2nd time and you've got to list of also run the name of potentially generated fall by caspase key to a started in data working because this point had like to thank a researcher who was a synonym so that OK that's that's the spare time on the resolution hearing and 2 resonators and because eventually he saw on my paper on enjoy all the test of strength way that that I saw before it's defender and then link but the other string of the makes sense like that that should Kaspersky but then he sent me this list of of names that extracts from because breast images of like this is a random string this should be hard-coded about that was in there the the the link and severity between sometimes is of demand ideas all of the money if we look at this number right seems to be really serial for example on the C 6 slide is a but are sometimes mentioned is 0 0 8 1 8 4 we both have its soul that on some theory and the nice thing to do nobody about the naming conscience seems to be a more necessary so it's a purely a speculation but to the maybe have to 1st number so much as a year of creation and usage of on just a sec slide it's 2 so of 8 and to so the around 12 and 13 for forces of something but we don't have any proof is simply a speculation and maybe it's a it's zz idea and diversion of all sort of combining idea still some the reason that I don't know and as a link between
each sample is of course a naming co-mention goes or the name would mentioned by the half-caste been extract is it alone name by developed it's not our naming convention soul on every case they choose Morris the captain characters to identify model up and
learning between each somebody is a really really bad residuals in mind region so for for example of if you look at the string of so registry gave you have a mistaken to me than my own have often think about this and also if you can and should is the type of the Basra were hilarious but if you look at the at the yellow marked is a come up to negotiate strain you you realize like 1 letters should be that different areas was of looking the bunny binary instant in Israel so the strings persons like OK this binary does something the register can and with a piece like because of like accessing the makers sapi secular and many of IP so I was looking how how bags of uh interacts with a 2nd with a binary could like do with the registry when modifying and the 2nd there and I realized with there's names that's written wrongly like this should work but when the binary Ronald works like maybe it's trying something of has a bargain there and then I realized that what is writing to is registered usages configuration not dating a take his like so if if they wouldn't have placed the type 1 amenable to maybe have been researching Piecyk forever but because it plays the title I save time comes great but the
and and there's all it even a stronger link between them is reform of CC always that comes it's the Trento covered In a generic you to that journal and uh reform a dish Cedric the being on the and that we were able to list every of slides 10 directory and that we fold the directory for several different by Rafa's G 13 is is a directory used by do no matter at that it is the fashion of the new and all states have we've got DB put to date for about a half and we're going shift see fall defective it's 1 of the sample developed by the group and just for information on the caspase to built you have some information about defocus routes oxidant were coming that means her its heart beating and it's really to French the developers but I'd French and I never thought this well before to Kaspersky so all did increase French-speaking for me it's really the beat exaggerate and that's why I'm going to speak
about attribution no of this case and the the a lot of
the articular people Exeter at point of French developers and that is it decided to form me clearly manipulate information to the point of French developers certificate of stuff for example all the if you look at the slide to g of a is to 48 yeah maybe but convinced and a term that means smart people I never heard those the usage of teaching french to a to identify smart people so for me it's not really a true to get the idea that Canadians maybe even
speak with friends and so maybe people at the back in the tree that there's a graph that I decided to whom the least every CC and check which a country that is used on the system there typically are reformed of CNN website Italian website American website and bilking FSO said that DFT is not which frostbit for Burkina Faso's uh Hong Kong the sau job yeah it did just the jammer UK basically on the city we don't fight compromise websites like this you can go on 1 website we formed a university her company and sometimes it was fake website uh and that not always typically that for the Syrian government but in most parts of the city was what website so maybe have zeta developers to some reader of each of the Web pressed adopt as a she band then it's there and yeah there was another interesting story to the so 1 of the of the bar binaries has has SUSY server which is hosted on a jury in travel agency website so I don't think this is anything suspicious but I wanna my my boss put me on on this website as that like a so he's he's Algerian anti-Semitic there's there's no travel agency in this place in Algeria there a vesicle is the a or a travel nowadays like is no need for Joe agencies and the location at the village was installations he says look at and he he doubts that there's a collisions you there and even if the original agency it's area and probably the stroll agency poses server on the United States uh poster session maternity believe that is what is our fate so here
is there's a map of the location of each city so for changes it's only Hong Kong but I can simply drove Hong Kong on the on the website so that's why it's water the so as I explained that
the the report point on the French and on bad argument that to reform of some of the more of an event French needs for example under the HTTP request a generated by is the matter to accept on ungracious set to ff and other those I example he's a compiler of the long and set the prom wages is set to French as the existence venture and the there's a thinking is only the cost and the on the new it is a developer's so didn't removes a pass off condition of arithmetic library and I read tickets uh was rated and French and that in english we still see at the end the the soul ofcourse horror exist to before to American sit at my compiler or in a lot of from region manipulated that but it's a superior effects of forest and the final easy
also all information for the attribution uses those 2 6 slide where is action to a yeah point of French integer insurgency for this growth of the company yeah it as pointed like this decision should thank you to the Canadian intelligence agency for prying slave on race race history actually Michigan lake that they have to slow in our in our research
yeah but everybody knows that attribution is not so easy and Germany's that and that's the so called case in France and pottery are really good for bad attribution for example the newspaper said that Israel this French guy is a canadian guy to that and for example manual from was higher jurists of Fidelity's doesn't really know the difference between here and post carrier so she makes in the stake in there and now that usually we Austrians we have the problem there Germans which is like it's not directly in itself but is an insult and calling of Australian in were saying this is this is a different continents so yeah that condition is not so easy so thank you for
your attention but just for information on the finance slide we we provide 2 those organizer you will have the legal or all well to get a list of harsh of this and then I some but it's it's a rights there are in don't so if you have any questions knows there's no later in the bar thank you it few
chart for