P-wave of malicious code signing

Wednesday 2 October 11:50 - 12:20, Red room

Yuta Sawabe, Shogo Hayashi & Rintaro Koike (NTT Security Holdings)

These days, regardless of being related to APT or crime, many malware and malicious files are code-signed. This is largely due to the existence of code-signing certificate sellers that play a role in the ecosystem. Instead of preparing code-signing certificates themselves, attackers can buy them.

We took a serious look at the interesting behaviour of code-signing certificate sellers. Prior to selling the certificates to their customers, they had signed to benign software using the certificates and posted the signed software to online malware scanning services to test whether the certificates were judged as expected (not only valid, but also benign). Such inspections occurred long before the certificates were sold and abused by attackers.

We collected the files posted by these sellers and harvested code-signing certificate information that could be abused in the future. This was a kind of experiment to predict the future. As a result, we succeeded in predicting future abuse cases. This could be an effective approach against code-signed malware and malicious files.

In this presentation we will first introduce the code-signing certificate sellers and their ecosystem. Then, we will illustrate their interesting inspections with a detailed timeline. Finally, we will present the approach we have developed and evaluate its effectiveness.

This presentation will allow the audience to understand the ecosystem related to the code-signing market for threat actors. It will also help the audience to understand certificates seller's interesting approaches and the overall picture. This knowledge will allow SOCs, IRs, CSIRTs, and other personnel to take proactive measures against code-signed malware and malicious files.

 

 


Yuta-Sawabe.jpg

Yuta Sawabe

Yuta Sawabe is a SOC analyst at NTT Security Holdings, where he is primarily involved in log analysis and malware analysis. He previously worked on malicious domain names. His is an Information Processing Society of Japan JIP Special Paper Winner (2019). He has spoken at Botconf, HITCON, JSAC and CODE BLUE in the past.

 

Shogo-Hayashi.jpg

Shogo Hayashi

Shogo Hayashi is a security analyst at NTT Security Holdings. His main specialization is responding to EDR detections, creating IoCs, analysing malware and researching cyber threats. He is a cofounder of SOCYETI, an organization for sharing threat information and analysis techniques with SOC analysts in Japan. He has spoken at JSAC, VB, SAS, CODE BLUE, and has written several white papers and blogs.

 

 

Rintaro-Koike.jpg

Rintaro Koike

Rintaro Koike is a security analyst at NTT Security Holdings. He is engaged in threat research and malware analysis. In addition, he is the founder of "nao_sec" and is in charge of threat research. He focuses on APT attacks targeting East Asia and web-based attacks. He has been a speaker at VB, SAS, Botconf, AVAR and others.

Back to VB2024 Programme page

Back to VB2024 conference page

Register for VB2024

Other VB2024 papers

Android Flutter malware

VB2024 paper: Android Flutter malware, Axelle Apvrille

CeranaKeeper: a relentless shape-shifting group targeting Thailand

VB2024 paper: CeranaKeeper: a relentless shape-shifting group targeting Thailand, Romain Dumont

A wild RAT appears: reversing DinodasRAT on Linux

VB2024 paper: A wild RAT appears: reversing DinodasRAT on Linux, Anderson Leite & Fabio Marenghi

Reviewing the 2022 KA-SAT incident & implications for distributed communication environments

VB2024 paper: Reviewing the 2022 KA-SAT incident & implications for distributed communication environments, Joe Slowik

Dark deals: unveiling the underground market of exploits

VB2024 paper: Dark deals: unveiling the underground market of exploits, Anna Pavlovskaia

SO that looks suspicious: leveraging process memory and kernel/usermode probes to detect Shared Object injection at scale on Linux

VB2024 presentation: SO that looks suspicious: leveraging process memory and kernel/usermode probes to detect Shared Object injection at scale on Linux, Daniel Jary

P-wave of malicious code signing

VB2024 paper: P-wave of malicious code signing, Yuta Sawabe, Shogo Hayashi & Rintaro Koike

Project 0xA11C: deoxidizing the Rust malware ecosystem

VB2024 paper: Project 0xA11C: deoxidizing the Rust malware ecosystem, Nicole Fishbein & Juan Andrés Guerrero-Saade

Sugarcoating KANDYKORN: a sweet dive into a sophisticated MacOS backdoor

VB2024 paper: Sugarcoating KANDYKORN: a sweet dive into a sophisticated MacOS backdoor, Salim Bitam

Leveraging AI to enhance the capabilities of SHAREM Shellcode Analysis Framework

VB2024 paper: Leveraging AI to enhance the capabilities of SHAREM Shellcode Analysis Framework, Bramwell Brizendine

Automatically detect and support against anti-debug with IDA/Ghidra to streamline debugging process

VB2024 paper: Automatically detect and support against anti-debug with IDA/Ghidra to streamline debugging process, Takahiro Takeda

Go-ing arsenal: a closer look at Kimsuky’s Go strategic advancement

VB2024 paper: Go-ing arsenal: a closer look at Kimsuky’s Go strategic advancement, Jiho Kim, Sebin Lee & Sojun Ryu

Cybercrime turned cyber espionage: the many faces of the RomCom group

VB2024 paper: Cybercrime turned cyber espionage: the many faces of the RomCom group, Vlad Stolyarov & Dan Black

Don't be a PUP-pet: exposing pay-per-install networks

VB2024 paper: Don't be a PUP-pet: exposing pay-per-install networks, Dmitrij Lenz & James Wyke

Ghosts from the past: become Gh0stbusters in 2024

VB2024 paper: Ghosts from the past: become Gh0stbusters in 2024, Hiroshi Takeuchi

Shadow play: WildCard's malware campaigns amidst Israel-Hamas conflict

VB2024 paper: Shadow play: WildCard's malware campaigns amidst Israel-Hamas conflict, Nicole Fishbein & Ryan Robinson

Supercharge your malware analysis workflow

VB2024 paper: Supercharge your malware analysis workflow, Kevin Hardy-Cooper & Ryan Samaroo

From code to crime: exploring threats in GitHub Codespaces

VB2024 paper: From code to crime: exploring threats in GitHub Codespaces, Jaromir Horejsi & Nitesh Surana

The Mask has been unmasked again

VB2024 paper: The Mask has been unmasked again, Georgy Kucherin & Marc Rivero López

CrackedCantil: a malware symphony delivered by cracked software; performed by loaders, infostealers, ransomware, et al.

VB2024 paper: CrackedCantil: a malware symphony delivered by cracked software; performed by loaders, infostealers, ransomware, et al., Lena Yu

Who plays on AZORult? An unknown attacker collects various data and spreads additional payloads with AZORult for around 5 years

VB2024 paper: Who plays on AZORult? An unknown attacker collects various data and spreads additional payloads with AZORult for around 5 years, Masaki Kasuya

Confronting the surge of macOS stealers in 2024

VB2024 paper: Confronting the surge of macOS stealers in 2024, Kseniia Yamburh & Mykhailo Hrebeniuk

Code blue: energy

VB2024 paper: Code blue: energy, Righard Zwienenberg & Josep Albors

Marketplace scams: neanderthals hunting mammoths with Telekopye

VB2024 paper: Marketplace scams: neanderthals hunting mammoths with Telekopye, Jakub Souček & Radek Jizba

Multimodal AI: the sixth sense for cyber defence

VB2024 paper: Multimodal AI: the sixth sense for cyber defence, Younghoo Lee

Down the GRAYRABBIT hole - exposing UNC3569 and its mastermind

VB2024 paper: Down the GRAYRABBIT hole - exposing UNC3569 and its mastermind, Steve Su, Aragorn Tseng, Chi-Yu You (YCY) & Cristiana Brafman Kittner

Hospitals, airports and telcos - modern approach to attributing hacktivism attacks

VB2024 paper: Hospitals, airports and telcos - modern approach to attributing hacktivism attacks, Itay Cohen

Breaking boundaries: investigating vulnerable drivers and mitigating risks

VB2024 paper: Breaking boundaries: investigating vulnerable drivers and mitigating risks, Jiří Vinopal

Life and DEaTH: building detection, forensics, and intelligence at scale

VB2024 paper: Life and DEaTH: building detection, forensics, and intelligence at scale, Selena Larson & Konstantin Klinger

Workshop: Writing malware configuration parsers

VB2024 Workshop: Writing malware configuration parsers, Mark Lim & Zong-Yu Wu

Unveiling shadows: key tactics for tracking cyber threat actors, attribution, and infrastructure analysis

VB2024 paper: Unveiling shadows: key tactics for tracking cyber threat actors, attribution, and infrastructure analysis

Open by default: the hidden cost of convenience in network security

VB2024 paper: Open by default: the hidden cost of convenience in network security, Aurelio Picon

Octopus Prime: it didn't turn into a truck, but a widely spread Android botnet

VB2024 paper: Octopus Prime: it didn't turn into a truck, but a widely spread Android botnet, Thibault Seret

Modern-day witchcraft: a new breed of hybrid attacks by ransomware operators

VB2024 paper: Modern-day witchcraft: a new breed of hybrid attacks by ransomware operators, Vaibhav Deshmukh, Ashutosh Raina & Sudhanshu Dubey

Unveiling the dark side of set-top boxes: the Bigpanzi cybercrime syndicate

VB2024 paper: Unveiling the dark side of set-top boxes: the Bigpanzi cybercrime syndicate, Alex Turing

SPYDEALER used for mobile Chinese domestic surveillance

VB2024 paper: SPYDEALER used for mobile Chinese domestic surveillance, Paul Rascagneres & Charles Gardner

Arming WinRAR: deep dive into APTs exploiting WinRAR’s 0-day vulnerability - a SideCopy case study

VB2024 paper: Arming WinRAR: deep dive into APTs exploiting WinRAR’s 0-day vulnerability - a SideCopy case study, Sathwik Ram Prakki

Over the cassowary’s nest - dissecting Turla’s latest revision of the Kazuar backdoor

VB2024 paper: Over the cassowary’s nest - dissecting Turla’s latest revision of the Kazuar backdoor, Daniel Frank & Tom Fakterman

TA577 walked just past you: indirect syscalls in Pikabot

VB2924 paper: TA577 walked just past you: indirect syscalls in Pikabot, Emre Güler

An open-source cloud DFIR kit - Dredge!

VB2024 paper: An open-source cloud DFIR kit - Dredge!, Santiago Abastante

Byteing back: detection, dissection and protection against macOS stealers

VB2024 paper: Byteing back: detection, dissection and protection against macOS stealers, Patrick Wardle

Extending STIX 2.1 to capture malware incidents

VB2024 paper: Extending STIX 2.1 to capture malware incidents, Desiree Beck

Spot the difference: Earth Kasha's new LODEINFO campaign and the correlation analysis with APT10 umbrella

VB2024 paper: Spot the difference: Earth Kasha's new LODEINFO campaign and the correlation analysis with APT10 umbrella, Hiroaki Hara

How to hunt geopolitically driven Bitter APT operations

VB2024 paper: How to hunt geopolitically driven Bitter APT operations, Shengbin Bao

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.