Welcome back everyone to one of those video effects.
But my goal is this under worse engineering course.
In this video how we are going to do a demo of how we can analyze a suspicious of malicious speak app
that contains X like traffic.
So in the pre-history of videos we talked about wireshark we talked about that that captures we talked
about Fritos and how we can narrow down our search reserves.
And we also talked about exploits Gates as a delivery mechanism.
There's that movie are going to combine all these aspects are we going to look at the peak up in Wireshark
and we'll be applying a bunch of fingers to basically analyze and extrapolate them and all them that.
So one of the good resources for downloading peak apps can be dyspepsy card malware traffic analysis
dot net.
This website is an excellent resource for the gaps that are explicitly littered with exposed Gates malware
sends spams.
So this website contains a collection of for all fifteen hundred feet samples.
You can download them and you can start analyzing those gaps to understand how malware traffics are
captured and how exploit it can be analyzed.
It contains a lot of different scenarios about ex-drug Gibbs spam's Fantomex etc. so all those peak
apps can be really really helpful for you to analyze and get more hands on experience or where analyzing
malicious code captures.
So I just wanted to bring up that all these download activities and analysis activities should be carried
out and you will wash all the wiring.
So as you can see currently I'm in my Windows environment and I have downloaded one of the peak apps
from the site and here's the pick uploaded in washer so we can begin by looking at all the UDP request
and response.
See here is my filter if I press enter it shows that there is a get request followed by another get
request that has a pretty long and vear you or I Papen something similar to what we saw in our previous
videos.
So this you are a pattern.
It doesn't mean that it's actually bad but it does point to some suspicious activity because a lot of
times X-Rite states have these kind of weird your patterns.
So this was followed by a response which came out to be a text Sagal.
So most probably this might be the landing page.
There is another request that is followed by a text here.
So probably this is another response that came back from the X-Rite it again it can either be a landing
page or probably some subset of response that was delivered back to us in the race under get request
which is followed by a response that has mine type of SHOCKLEE a flash.
So it seems like after the exploit Kate was able to enumerate our machine it figured out that located
browser it contains that one it will warn you in effect it'll be flash.
That's why a download in a flash exploded onto the machine and there is another get request.
This seems like to be related to the payload download because immediately after this request we are
seeing some Borst activities as well.
So why post activities interesting here is because once malware are the final payload is trub onto the
system the malware will start performing its command and control by sending signals to it so.
And that's where it tries to pull some data to its command and control.
So that's why these false requests can be really interesting to look at.
So let us start by examining the First get requests so we can go to follow.
They should be the same on DCP stream.
So if you see here it seems like the individual visited this Web site and this was the response.
And if you look at the cold closely it seems like a pretty normal as cheaply as DML could.
So you have to figure out the location from where the infection might have started.
So if you scroll all the way to the down you'll see that there is a checkbox could that is present at
the very end.
This javascript seems to be creating an ice free as you can see it's defining a variable.
Q I see that I-frame and then it is creating an element with the same variable name.
So it's basically trying to construct an I-frame that this word high and zero pixel border and the I-frame
is pointing to this particular issue repeat request.
And this seems to be exactly like the request which we just saw in our kneecaps.
So probably this is where the infection actually is beginning from now.
And one thing which I want to bring here is that because this javascript is present all the way at the
end of the SDM code of this website it's highly likely that this Web site might be compromised by the
attackers and they have injected this code into this website.
A lot of times popular content management systems like Wordpress or Drupal except for they they have
a bunch of one notabilities are probably one of their plug ins will have some little video that they
might use can compromise your website.
And once they compromise it they can inject these kinds of scripts into them so that any traffic that
comes to your website will basically get infected by it exploit its.
So let us go back to our big question response here.
So that's the first one that they sledged to this site and get get requests that is right click on a
go to follow the stream.
If you follow the should it be stream it shows that this was the get request and it's the same one which
we saw in the Jetsons scrape in the main website in the previous request.
So the zero holes we got a response and it seems like this web page is also containing in I-frame and
javascript which is pointing to under malicious you are.
If you scroll down further you'll see that there are certain strips which are basically trying to enumerate
browser or trying to look at User-Agent.
So all these groups are pretty legitimate and attackers used these groups to figure out your browser
or figure out the words in Orfield browsers figure out the plugins that are there in your browser.
If he continues trawling down you will see that there is a post the request and the response is very
off the script of script.
So this seems like the name page of the exploited as you can see this is heavily office get hired and
literally nothing can be read in plain text here.
So this is why X-Rite gaps are really really hard to track or really really difficult to understand
because of their heavy obfuscation and my deeper levels of steps in world.
It's not easy to track them when you have a very long Piqua file.
So going back to our request response bill so we looked at this request.
Now let's check this one and seems like it's a response is a flash floods are going good will follow.
It should be the street and as we guessed this is a shockwave flash file and the magic byte is CW as
it means it's a compressed Flash file.
So what do we do here that say if you want to analyze this flash why what they can do here is we can
go to trial.
You can go to export objects and select DP ones we selected the we can select request that shows that
it's an application shockwave.
You can click on see and we can see that probably let's say on our next stop Lekan make as magicians
start and establish s
you're going save the flash flood.
Similarly if let's say you want to save the GMAT pages that we just analyze.
You can just select them and you can click on Save just like we just did with chalk the Flash file.
So if you want to analyze the started landing pages or the browser and munitions capes you can similarly
save them here and you can play with them in their day off the station those.
So let's see those days and go back to our request response.
So we know that this was a flash exploit.
Now there is another get request and.
Seems like there was no response associated with this.
We can just close it off.
So this is how we can analyze the data to figure out whether it contains any tracings off exploitive
activity or not.
So this was a great deal more about how we can analyze exploit gates and donated radios will begin analyzing
the suspicious flashlights and the mandate that gets downloaded from the X-book is actual watching.