>> Today, our demo will be working with the IllusionBot,
and you can download it from this URL from
the same GitHub that we got the direct sample.
We're going to take our Windows VMs that we made
previously and reset it.
You can reset your Linux VM as well.
A common trick for a Linux VM, particularly Kali,
is to change the settings for
the display if the VMware Tools
doesn't automatically resize the interface.
That's much better. Let me confirm our IP address.
On this one we have 10.0.0.1,
which should be on
the same little network as our Windows box.
It's 10.0.0.2.
It should be able to ping each other and just
make sure before I begin infecting things,
I always like to double-check my network to make
sure it's not going out to the Internet,
it's not added like this option.
It is indeed on our own custom VNet.
I'll select to run Wireshark
>> on my Linux routing machine.
>> Since we are going to start running services
here that catch and
analyze network traffic and other things,
I should warn you that it is very dumb
to do it as root like I'm doing right now.
Don't do that. But I'm going to do it anyway.
Because if the program like Wireshark gets compromised,
which is completely possible because it has
lots and lots of different plugins modules
for protocols contributed by
lots of people and they haven't fully been vetted,
it can be a very bad thing.
We're going to just look at what
IP address the different interfaces have on Wireshark,
and we are going to watch the 10.0.0.1
interface because that is where
the traffic from the infected machine will be going.
There's no traffic right now and we're going to just do
a full ping on 10.0.0.1.
We are getting something back.
Pop over here.
We see these echo ping requests
and then we have these ARP requests.
Completely normal traffic.
This time we're going to be working with
the IllusionBot downloaded from
the same place as the dire
>> example we were working with.
>> The industry-standard password is infected.
Antivirus companies usually know better than to try
to open zip files with that password.
We're going to simply do
some dynamic analysis on this malware.
We're going to, what I typically do,
cert capture that and start the binary.
Then watch the traffic.
We see from this IP address is
trying to reach out to this internet
IP address and is
trying to go over port.
Its origin port is not a big deal,
but its destination port is 6667.
What we want is the malware to act normally,
to think it's in a safe environment.
What we're going to use is a few tools,
particularly a tool called INetSim.
INetSim is a tool that basically emulates
many different services listing
on standard default ports.
INetSim is all we need to type in.
It starts listening on all these ports.
It'll tell you the process ID's.
It'll tell you where it's storing the logs,
where it's getting its data from,
and where it's producing its report.
Here, in particular, we want to see
where the config file is coming from.
I can highlight this in the terminal and do
Control Shift C to copy within the terminal,
and I'm going to kill these processes
>> by hitting "Control C".
>> The simulation has stopped,
>> nothing is listed on those ports anymore.
We can verify this by doing
netstat -untap is what I usually go with.
You can look up for yourself what the options are,
and we can see DHCP client
is running on those ports
which are standard DHCP client ports.
I'm going to use Vim space Control Shift V
to paste what I copied before,
which is the INetSim config file.
Vim is VI improved.
It's the my default text editor,
command-line text editor.
There are friendlier ones like Nano, but I like vim.
The first thing we're going to do when we're
editing our config file is I want to
do a slash and then 10.0.0.1,
or 10. is fine.
It's basically searching the document for 10.
Here, the first line is where
we see a service bind address parameter.
We're going to uncomment this line,
which means to start paying attention to it,
which tells INetSim that it should start paying
attention to this parameter that we're
giving it and serve whatever default it has.
I'm going to change the address
that it should bind to 10.0.0.1.
The reason is if we were to pull up
another terminal and do
an IF config to see our IP address,
we'll have one Internet behind the Net.
It goes out to the Internet and it has
this IP address and then
our other interface has this IP address.
By default, it would probably go
with zero and it would emulate
all the services on the ports
on this IP address, this interface.
We want to guarantee that it's
>> running on this interface.
>> I'm going to hit "Escape"
>> because them syntax is a little
>> weird and do another search for DNS.
The first option is a DNS bind port.
We're going to keep it as default.
Hit "N" for next,
hit "N" for next.
DNS default IP, "N" for next,
"N" for next, and "I" for insert.
I'm going to delete the comment on this line.
I'm going to specify that the address,
it should return for
all DNS queries will be this one, a 10.0.0.1.
I'm specifying that not only am
I everything it's ever looking for,
but I am also all these things.
There's a fixed time server on here.
There's a fake HTTP server and all sorts of good stuff.
Now we've configured INetSim to how we
want it. Execute again.
Again, we probably shouldn't be running this as root.
But we can over
our Windows computer just open up Internet Explorer.
It goes to Microsoft.com
but it's intercepted by our INetSim program.
The DNS server says, "Oh,
Microsoft.com has this IP address, 10.0.0.1."
It goes there and the web server that
INetSim has set up will
>> return this page for everything.
>> Google.com will return this page anything I want.
You can also specify particular files.
All PHP files will return something,
or all EXE files will return a file that
>> I have pre-specified for INetSim.
>> Here we are, and we see all this traffic.
This was from the browser that I just opened.
I'm going to reset it and
our malware should still be active.
It doesn't look like it's calling out
anymore. There it is.
You'll see that it's not using
DNS to resolve an IP address,
it's trying to contact that IP address directly.
That might tell us one of a few things.
One, it might be clumsily written piece of malware
because it's not taking
into account machines that are behind proxies.
But that's not our problem.
Our problem is, we want to know
what traffic is being sent out.
We want to know what it's doing.
There is something cool we can do,
in that we can redirect not only all domains,
but all IP addresses.
We can do that pretty simply.
I'm going to stop capture about for money.
I will try to grab hosts indicators later,
but now I'm trying to collect more network indicators.
In order to capture all the IP addresses,
instead of just domain names,
I'm going to add a route.
This syntaxes route add.
I'm going to give it a base address,
0.0.0.0 mask, what it should ignore, 255.255.255.255,
and then the IP address of
where I want all this traffic to go.
Let find the all traffic should be funneled to
this IP address, which is 10.0.0.0.1.
Over on the Linux side,
I'm going to have to open another terminal
Control Shift N,
and I'm going to add an IP tables route.
Iptables -t nat -A PREROUTING -i
eth1 because that's where we want to
direct all of our traffic to,
and then -j for redirect.
Now suddenly, it made a successful connection.
We can look at the successful TCP connection,
and we can see that it's IRC.
In the red, we can see
the victim network traffic first since pass 2580,
and its nickname it's username pretty much is this.
The server responded with notice authentication.
Welcome to irc.inetsim.org because
IRC is also emulated here.
Then it tries to join
the channel skaters underscored 1990.
If we were security researchers,
we could hop onto that IP address,
the IRC channel skaters 1990 on that IP address,
and we could find other bots there.
That's happened before,
>> I've had numerous people tell me
>> that they were working on hosting
provider and someone notified them
that they're hosting some malicious content
and they look at it and it's an IRC chatroom,
and a lot of old malware use
that as command and control mechanism,
because they could still say relatively anonymous.
But the problem is that
they usually didn't have good authentication.
The password we can see to this channel was 2580,
so we can hop on this channel now.
Maybe I want to interact with this bot.
Maybe I want to send it commands.
Maybe I want to try to control
it. Well, how can I do that?
Well, luckily for us,
we can simply change the config again for INetSim.
Go to IRC, see where it's starting that service,
for pound sign to comment it out,
Escape Colon W Q for write to then quit,
and then rerun INetSim.
It's doing everything it did before except now
the IRC port and process are no longer listening.
We can see that there's
an attempted connection and it's rejected.
The attempt in connection came
>> from 10.0.0.2 from vector to
>> machine tried to go to this IP address
is a synchronized packet,
and then our machine said reset.
I would really like to introduce if
you don't already know about a program called Netcat.
Of course, like INetSim,
you can just say man,
and then the command nc,
and it'll tell you all about it and how to use it.
I'm going to use nc - l for listen,
and then -p and specify a port.
I'm going to say nc -l and then -p for 6667,
so now listening on that port.
It looks like our malware isn't calling back anymore.
I wonder why, they did call back.
Let me just wait in a second.
We're listening on this port
and we see it gave the same password.
It's using the same the name,
which is that looks like the host name of the machine.
We can verify that.
Certainly, when you right-click on my computer.
That's the host name.
Using the host name of the infected computer.
I'd be willing to bet that's a time stamp.
Maybe something else, I don't know.
We could do more analysis.
It is the same number,
it might be some identifier,
like a campaign code built-in to the malware.
Further reverse engineering would
reveal exactly what it is.
But I'm not sure if it's important right now,
but I can guess is maybe not.
Here with Netcat, I can also send commands back.
It's not responding to some commands here,
so maybe it needs some
>> specific string before it reacts.
>> I'm going to just play with things
because I like poking at things and send a lot of As,
and then Control C will kill the connection.
Let me see if that did anything.
But binary.exe has crashed.
Apparently the malware author,
didn't write this malware very well.
This interesting to me.
If we were vigilantes,
we could get on to this IP address using this password,
and we could jump on there using some host name,
maybe even this and this user,
join this channel and then send all these
A's to everything that is listening on that channel.
Crash all of the malware on all those computers,
and let's see if it calls back.
Reset, clear it,
and it doesn't look like it's calling back.
I will say it is a reckless endeavor
and it may not be appropriate.
In fact, I'm pretty sure it is illegal
because you are executing code,
or actually you're stopping code
from executing on other people's machines.
Those are not your computers,
even if they're compromise.
The appropriate thing might be
>> to notify law enforcement.
>> They probably wouldn't do anything though,
because they're even bound more
tightly about what they can and can't do.
They probably would shut
down the command and control server,
or they would bring
in an expert to come
in and dismantle the botnet, if you will.
Microsoft has done that with law enforcement
to take down large botnets.
Sometimes it's been very successful,
sometimes it has not been.
But if you interfere like that,
I'm not a lawyer, so I'm not going to say
that is legal or not.
If we wanted to play with this and more,
I would suggest using this build.exe.
Here we have some interesting options, binary.
It says open 1.1 bot binary.
I'm just going to go with this.
Here it looks like this was
the IP address that it was picking out to,
this port, the channel,
the password it was using.
Let's test our DNS resolving
manipulation capabilities like freenode.net.
>> Usually malware has this backup command
and control server functionality.
I'm just going to go to Google.com.
I'm going to change this to, I don't know,
555 and 111 just to see what happens.
It looks like there's a web panel that would open,
refresh every five seconds.
It looks like that Socks4 and Socks5 proxy setting
that we see here, can be verified.
It looks like it will open up FTP server.
It looks like on the IRC,
the bot password is this.
I don't know what this does.
It looks like there's a firewall bypass,
and we can see that in here.
Authorized applications.
It looks like it
white-listed itself in the location
that it was executed,
so an attacker would
probably compromise a machine drawn into
a directory somewhere that a user's not likely
>> to access and then execute the malware.
>> It looks like it has a kernel driver as well,
so save services state in the registry.
These are all interesting options
that I would suggest that you play with.
I'm going to say save, and that is saved.
Also going to show another tool here.
Process Explorer,
it's basically Task Manager on steroids,
it is incredibly powerful.
A Process Hacker is very similar
in interface and very similar in function.
But it lets us watch processes very
closely and identify the DLLs
that are injected into them.
I would also like to run autoruns;
bit of a screen, autoruns.exe and autorunsc.exe,
is this one will produce a console output,
and this one will produce a GUI.
The console output is useful
for if you want to chunk all of
the current autorun entries into a file,
and then compare that file
to another file of
the autorun entries after the malware has been run,
so you can see if anything's been added.
It looks like autorun is having some trouble.
It's okay, it happens.
It maybe the malware, probably not.
It's highlighted some things here.
In the configuration for
the malware it mentioned kernel driver.
We might want to check drivers and see where this it,
we might like to look at the host log and
see one of these files.
See if there's any mention of them,
it doesn't look like it.
We could look through all of these individually and we
can take a before and after snapshot,
because remember, we've already
executed this binary before,
or a similar one.
But the best way to
be sure is to keep running over and over again.
But it may not have a persistence mechanism.
Now on my wall it does.
Autoruns usually finds when malware is doing something.
Let's see what's going on here.
It looks like our victim machine is trying
to connect to this port,
but it's closed, so I'm
going to start listening within that cat again.
There was our DNS query, freenode.net.
Let's see if it made another query.
We can do that just by typing DNS.
I tried to resolve crl.microsoft.com
and we gave it our own IP address.
Again, it was probably some internal Microsoft tool,
and here it was asking for freenode.net,
and it's connected in given us
the same configuration data.
It's given us the password of 2580
so not the other value
that we had before that
we entered into the configuration.
That is interesting.
This did not change.
But let's see if the other value did.
Yes, the channel I
tried to join was one that we had defined.
It looks like this malware is configurable.
I like to crash things,
so I'm going to send it a bunch
of data and see if it crashed it.
It did indeed crash it. I hope
that you play with us and enjoy it.