Skip to content

4ARMED/volatility-attributeht

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

8 Commits
 
 
 
 
 
 

Repository files navigation

Volatility Hacking Team Attribution (attributeht) plugin

This plugin searches a memory dump for evidence of the Hacking Team Galileo Remote Control System (RCS), and attempts to attribute the infection to particular Hacking Team client.

Background

The 'elite' level implant maps a region of shared memory using a 7-alphanumeric character name in order to prevent the installation of lower-level implants. This shared memory section is fairly unique, and can be detected using a Regex.

###Attribution In addition, the list of watermarks for Hacking Team clients was leaked, allowing an attempt at attribution to be made by matching the watermark to a client installation.

For more information, see the blog post here: https://www.4armed.com/blog/memory-forensics-detecting-galileo-rcs-windows

##How-to

The folder where the plugin is located should be passed on to Volatility using the --plugins= parameter.

volatility --plugins=volatility-attributeht --profile=WinXPSP2x86 -f test.raw attributeht

Running by default will attempt to identify any HT implants on the machine. The following flags affect how the plugin runs:

  -p PID, --pid=PID     Operate on these Process IDs (comma-separated)
  -n NAME, --name=NAME  Operate on these process names (regex)
  -e, --extract         Attempt to extract configuration data from memory
                        
  -D DUMP_DIR, --dump-dir=DUMP_DIR
                        Directory in which to dump configuration files
  -E, --onlyelite       Search for Elite Implants only
  -S, --onlyscout       Search for Scout Implants only

Extracting configurations.

If the --extract flag is used, then the plugin will attempt to recover configuration information from any implants it finds in memory. This includes AES keys for the scout implants, as well as full JSON configurations for the elite level implants. These are saved to the 'DUMP-DIR' location.

Example Run

An Example run is shown below with the 'extract' option enabled; the memory image for this is available at: http://hyperionbristol.co.uk/uploads/example_WinXPSP2x86.raw

This sample image has two different infections, an elite level infection from one threat actor, and an unmodified development scout infection. The plugin can differentiate between these.

root@4A-JG-Kali:/mnt/ramdisk# volatility --plugins=volatility-attributeht -f example_WinXPSP2x86.raw attributeht --extract --dump-dir=configs
Volatility Foundation Volatility Framework 2.4
Hacking Team Galileo RCS Implant Detection - 4ARMED Ltd
PID  Watermark Process Name     Implant Type   Threat Actor Confidence (Low-Certain)  C2 Server       Configuration File 
300  B3lZ3bup  pippopippo.exe   Scout          VIRGIN       Certain                   10.0.2.4        configs/scout_configuration_300.json
1852 3OqZ1N5a  userinit.exe     Elite/Soldier  FAE-FURLAN   Certain                   None            None
1888 3OqZ1N5a  explorer.exe     Elite/Soldier  FAE-FURLAN   Certain                   None            None
228  3OqZ1N5a  UsbCipHelper.ex  Elite/Soldier  FAE-FURLAN   Certain                   None            None
212  3OqZ1N5a  VBoxTray.exe     Elite/Soldier  FAE-FURLAN   Certain                   None            None
244  3OqZ1N5a  19pivy.exe       Elite/Soldier  FAE-FURLAN   Certain                   None            None
252  3OqZ1N5a  ctfmon.exe       Elite/Soldier  FAE-FURLAN   Certain                   None            None
264  3OqZ1N5a  msmsgs.exe       Elite/Soldier  FAE-FURLAN   Certain                   None            None
292  3OqZ1N5a  rundll32.exe     Elite/Soldier  FAE-FURLAN   Certain                   178.62.50.243   configs/configuration_elite_292_0xb03fe8L.json
300  3OqZ1N5a  pippopippo.exe   Elite/Soldier  FAE-FURLAN   Certain                   None            None

Configuration Files

Example recovered data is shown below for both levels of implant

####Scout Implant

{
    "c2_server": "10.0.2.4", 
    "watermark": "B3lZ3bup", 
    "process_name": "pippopippo.exe", 
    "pid": "300", 
    "key_data": {
        "server_key": "4yeN5zu0+il3Jtcb5a1sBcAdjYFcsD9z", 
        "evidence_key": "i6gMR84bxvQovzbhtV-if0SdPMu359ax", 
        "log_key": "uX-o0BOIkiyOyVXH4L3FYhbai-CvMU-_"
    }, 
    "threat_actor": "VIRGIN", 
    "implant_type": "Scout"
}

Elite Implant

{
    "s": {
        "migrated": false, 
        "version": 2012041601, 
        "remove_driver": true, 
        "collapsed": false, 
        "quota": {
            "max": 4194304000, 
            "min": 1048576000
        }, 
        "nohide": [], 
        "type": "desktop", 
        "wipe": false, 
        "advanced": false
    }, 
    "modules": [
        {
            "module": "addressbook"
        }, 
        {
            "module": "application"
        }, 
        {
            "module": "calendar"
        }, 
        {
            "buffer": 512000, 
            "record": true, 
            "compression": 5, 
            "module": "call"
        }, 
        {
            "quality": "med", 
            "module": "camera"
        }, 
        {
            "module": "chat"
        }, 
        {
            "module": "clipboard"
        }, 
        {
            "network": {
                "processes": [], 
                "enabled": false
            }, 
            "synchronize": false, 
            "mic": true, 
            "module": "crisis", 
            "hook": {
                "processes": [], 
                "enabled": true
            }, 
            "camera": true, 
            "call": true, 
            "position": true
        }, 
        {
            "list": false, 
            "module": "device"
        }, 
        {
            "capture": true, 
            "deny": [
                "*\\AppData\\Local*", 
                "*\\AppData\\Roaming*", 
                "*\\Skype\\Plugins\\*", 
                "*\\$RECYCLE.BIN\\*", 
                "*:\\Windows\\*", 
                "*.dll", 
                "*.exe", 
                "*.ini", 
                "*.lnk", 
                "*.ico", 
                "*.tlb", 
                "*.clb", 
                "*.dat", 
                "*.drv", 
                "*.ocx", 
                "*.url", 
                "\\\\.\\*"
            ], 
            "accept": [
                "*.doc", 
                "*.docx", 
                "*.xls", 
                "*.xlsx", 
                "*.ppt", 
                "*.pptx", 
                "*.pps", 
                "*.ppsx", 
                "*.odt", 
                "*.ods", 
                "*.odp", 
                "*.rtf", 
                "*.txt", 
                "*.pdf"
            ], 
            "minsize": 1, 
            "maxsize": 500000, 
            "module": "file", 
            "date": "2015-08-06 00:00:00", 
            "open": false
        }, 
        {
            "usb": false, 
            "mobile": false, 
            "vm": 0, 
            "module": "infection", 
            "factory": "", 
            "local": false
        }, 
        {
            "module": "keylog"
        }, 
        {
            "module": "money"
        }, 
        {
            "mail": {
                "filter": {
                    "dateto": "2100-01-01 00:00:00", 
                    "maxsize": 100000, 
                    "datefrom": "2015-08-06 00:00:00", 
                    "history": true
                }, 
                "enabled": true
            }, 
            "sms": {
                "filter": {
                    "dateto": "2100-01-01 00:00:00", 
                    "datefrom": "2015-08-06 00:00:00", 
                    "history": true
                }, 
                "enabled": true
            }, 
            "module": "messages", 
            "mms": {
                "filter": {
                    "dateto": "2100-01-01 00:00:00", 
                    "datefrom": "2015-08-06 00:00:00", 
                    "history": true
                }, 
                "enabled": true
            }
        }, 
        {
            "threshold": 0.22, 
            "autosense": false, 
            "silence": 5, 
            "module": "mic"
        }, 
        {
            "width": 50, 
            "module": "mouse", 
            "height": 50
        }, 
        {
            "module": "password"
        }, 
        {
            "module": "photo"
        }, 
        {
            "cell": true, 
            "wifi": true, 
            "module": "position", 
            "gps": false
        }, 
        {
            "onlywindow": false, 
            "quality": "med", 
            "module": "screenshot"
        }, 
        {
            "module": "url"
        }
    ], 
    "events": [
        {
            "start": 0, 
            "enabled": true, 
            "ts": "00:00:00", 
            "subtype": "loop", 
            "te": "23:59:59", 
            "event": "timer", 
            "desc": "STARTUP"
        }, 
        {
            "repeat": 1, 
            "start": 1, 
            "enabled": true, 
            "ts": "00:00:00", 
            "delay": 10, 
            "subtype": "loop", 
            "te": "23:59:59", 
            "event": "timer", 
            "desc": "SCREENSHOT"
        }, 
        {
            "repeat": 2, 
            "start": 2, 
            "enabled": true, 
            "ts": "00:00:00", 
            "iter": 1, 
            "delay": 120, 
            "subtype": "loop", 
            "te": "23:59:59", 
            "event": "timer", 
            "desc": "CAMERA"
        }, 
        {
            "repeat": 3, 
            "start": 3, 
            "enabled": true, 
            "ts": "00:00:00", 
            "delay": 900, 
            "subtype": "loop", 
            "te": "23:59:59", 
            "event": "timer", 
            "desc": "POSITION"
        }, 
        {
            "repeat": 4, 
            "enabled": true, 
            "ts": "00:00:00", 
            "delay": 120, 
            "subtype": "loop", 
            "te": "23:59:59", 
            "event": "timer", 
            "desc": "SYNC"
        }
    ], 
    "actions": [
        {
            "subactions": [
                {
                    "action": "module", 
                    "status": "start", 
                    "module": "device"
                }, 
                {
                    "action": "module", 
                    "status": "start", 
                    "module": "call"
                }, 
                {
                    "action": "module", 
                    "status": "start", 
                    "module": "calendar"
                }, 
                {
                    "action": "module", 
                    "status": "start", 
                    "module": "addressbook"
                }, 
                {
                    "action": "module", 
                    "status": "start", 
                    "module": "messages"
                }, 
                {
                    "action": "module", 
                    "status": "start", 
                    "module": "chat"
                }, 
                {
                    "action": "module", 
                    "status": "start", 
                    "module": "url"
                }, 
                {
                    "action": "module", 
                    "status": "start", 
                    "module": "keylog"
                }, 
                {
                    "action": "module", 
                    "status": "start", 
                    "module": "mouse"
                }, 
                {
                    "action": "module", 
                    "status": "start", 
                    "module": "password"
                }, 
                {
                    "action": "module", 
                    "status": "start", 
                    "module": "file"
                }
            ], 
            "desc": "STARTUP"
        }, 
        {
            "subactions": [
                {
                    "action": "module", 
                    "status": "start", 
                    "module": "screenshot"
                }
            ], 
            "desc": "SCREENSHOT"
        }, 
        {
            "subactions": [
                {
                    "action": "module", 
                    "status": "start", 
                    "module": "camera"
                }
            ], 
            "desc": "CAMERA"
        }, 
        {
            "subactions": [
                {
                    "action": "module", 
                    "status": "start", 
                    "module": "position"
                }
            ], 
            "desc": "POSITION"
        }, 
        {
            "subactions": [
                {
                    "mindelay": 0, 
                    "maxdelay": 0, 
                    "wifi": true, 
                    "stop": false, 
                    "bandwidth": 500000, 
                    "cell": false, 
                    "host": "178.62.50.243", 
                    "action": "synchronize"
                }
            ], 
            "desc": "SYNC"
        }
    ]
}

About

No description, website, or topics provided.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages