Original subtitles

one of the most important parts of the

cat and mouse game that malware

developers play with Defenders Network

Defenders thread intelligence folks is

creating malware that is very difficult

to detect today we're going to talk

about one of the ways that malware

developers use to make malware that's

more difficult to detect it doesn't make

it impossible there's still ways that

you can detect malware that uses

cryptors which is what we're going to be

talking about today but it does add an

extra layer of complexity and I actually

found a really good open- source Cryptor

that we're going to be going through

today um it is created by this person

named Daniel Bard um ma a o p on GitHub

um I'm going to leave a link down in the

description and I actually contributed a

little bit very very tiny piece of code

to this project and I plan on doing a

little bit more um with the project as

well but they've got a really great

GitHub um that has some resources of how

to use the kryptor this is a fairly

typical type of Cryptor um that you

might see like actually out in the quote

unquote wild um so it's actually fairly

good example of one that we can kind of

go through now it's unfinished he's got

a couple of things in the to-do list to

go through but it actually is unfinished

in a way that is kind of beneficial

we're going to talk about that here in a

second um but yeah let's just dive into

the code I'm going to do a full kind of

code walk through and kind of a process

walk through from a high level um but

let's start with what cryptors are so

cryptors you've got your your piece of

malware right so you've got malware and

that malware made up of bites this is

not anything revolutionary nothing super

surprising your malware is you know

created from a series of bites so zeros

and ones and zeros and ones and repeated

until the end of your malware what

Defenders are going to do is they are

going to build what are called

signatures based on these bites so they

are going to find places within the

malware that is indicative of what the

malware is or what the malware does

you've got different AV EDR things that

can do this in different ways um but in

general the way most signatures work is

they will find a bite string so let's

just say this string right here and they

are going to yint that out and say this

string means this is

malware that's ugly um so they're going

to write a

signature and they're going to say this

indicates that we are talking about this

malware okay so this is kind of like the

basics of network defense or you know

kind of like cyber security at least

against malware you're finding these

signatures within files that indicate

that this is a piece of malware a

specific piece of malware or at least

something that's malicious so I might

look into the code and I find a place

where it loads dlls in a very specific

way and I say okay anything that loads

dlls in this specific way is malware

well another part of the cat and mouse

game is okay well there are also

perfectly benign programs that use that

specific bite string or use that

specific way of loading dlls so you

can't just say that everything that does

it this way is malware otherwise you're

going to be blocking a bunch of

perfectly legitimate software this is

something that I have had to deal with

constantly in cyber security space with

my day job and with other research that

I've done so this signature building is

actually very difficult you're trying to

find specific areas within malware that

indicates

maliciousness but it only indicates

maliciousness it doesn't indicate

anything else that's it's incredibly

difficult I'm not going to get too far

into the weeds in this video because

we're talking about cryptors so the

reason why cryptors make it more

difficult for people who create malware

is that it takes the malware and instead

of it just being that malware we're

going to run it through another

layer and we are going to

create a second piece of code okay or

not a second piece of code but kind of

like a second executable this is going

to

be let's just call it crypted because

cryptors can work in several different

ways you can literally just base 64

encode a piece of malware and create a

stub or some kind of program that deop

skates it or takes it from a base 64

pieces piece of code to its raw binary

form and that will actually trick a lot

of AVS because a lot of AVS are very

very stupid um so I'm going to call it

crypted because it technically sometimes

can just be being encoded and that's

going to take these bites and transform

them into something different we're

going to call this piece of code red so

this piece of code is changed in you

know different ways it can be encrypted

it can be obis skated it can be just

different okay so we're changing the

entirity of this code I'm not going to

spend all of that time writing it out

zeros and ones you kind of get the

picture and it creates an encrypted

version the reason why this is more

difficult to detect is that now all of a

sudden this piece of code might mean

we're going to load this specific dll or

we're going to make a call out to this

you know C2 so that that may be what's

represented by this piece of code and

this encrypted piece of code that's not

present anymore you don't see the same

strings you don't see the same you know

raw binary format you're going to have

the encrypted version now here's the

difficult part and create encrypts at

least this right here is not runable by

the machine because it's encrypted this

is no longer raw binary format so what

will end up happening is you will have

the real code here and you will

have a

stub so this is going to be the stub so

this right here is the encrypted

binary let's just call it the obvious

gated

binary okay so what the stub's job is to

take the what the stub's job is is its

job is to take all of this right here

and turn it back into the original

malware form while it's running so the

stub is actually executable code that

will then decrypt or decate the code

that is bundled with it that is the

encrypted code here or the obus skated

code and turn it back into the original

malware code but it usually does it in

memory so it's not just going to decrypt

it drop to drop it the disc though it

can do that that's actually going to be

the example that we see here in a second

so it makes it a little bit more

difficult to create a signature because

this stub isn't inherently malicious

it's just doing normal dication stuff so

you can't necessarily call De obus

malicious in the same easy way that you

can call calling out to a C2 malicious

so it's much more difficult to create a

signature based on the stub and it's

very very difficult to create a

signature based on the obious Gated

binary but there are still ways that you

know Network Defenders can do it we're

not going to talk about that as much as

we are going to talk about cryptors so

this Cryptor right here fairly simple at

a high level what this Cryptor is

essentially doing is it is creating a an

obious skated binary using AES

encryption and then it appends the key

at the very end along with some padding

and then it creates a stub that is going

to take that encrypted binary that is

bundled with the stub it is going to

decrypt it and then it's going to drop

it into memory um and it's also got a

couple of pretty cool add-ons we'll talk

about here in a second it's got got you

know the ability to run it quote unquote

fileless um so it's basically going to

load that binary into memory and run it

you know basically like that instead of

you know dropping it to desk um and it's

got some anti-vm stuff as well so let's

walk through the code um so this is a

rust project because that's all I do

anymore is just malware rust stuff um

we've got two different parts we've got

the encryption part and we've got the

step part um I'm not going to show an

actual walkthrough of the code because

I'm actually in the middle of kind of

pseudo rewriting this um not fully

rewriting it but basically rewriting it

in such a way it's a little bit easier

to use so I'm not going to show a full

demo of this but um you can also access

it on GitHub pretty easily so this Crypt

part is the first part that we're going

to talk about let's look over here at

the source and look at Main um so here's

the part that I actually contributed

it's very very minimal basically all

it's doing is instead of requiring a

specific file name to encrypt you are

able to pass that as an input argument

which you know again it it was a matter

of of like a couple lines of code like

five lines of code um but essentially

what it does is it takes an input file

name and it is going to encrypt that

using as encryption and it will output a

key so here is the encrypted this is

going to be the um file that ends up

holding the encrypted bytes and it's

going to create this key now AES

encryption depends on on a set block

size usually of size 16 I believe um

yeah so as 128 requires a block size of

16 in order to ensure that you've got

block alignment there you add padding to

the blocks um or at least to one of the

blocks um so that padding size will

basically be the difference between the

block size and the um required block

size so if you got a block of size 12

you basically add six bytes of padding

to that and you will have a block of 16

that padding is usually just null bytes

um so yeah that where you set the nulles

there um you create a random string um

using the standard range from entropy

function here um you're going to fill

those bites so B basically that's what's

actually creating that um padding there

and you are generating your key um from

a slice you know so fairly simple stuff

there so that's actually creating the

key that's not um doing the padding the

padding is done down here I believe um

so for every single block within your

padded plane text bites so that padded

plain text bite is being created right

here um so we're extending that array by

that padding size that's where that's

actually happening if I were paying

attention to the code I would have known

that already um so we're going through

each individual block and we are

encrypting it so that's using that key

um right let's see so that's that Cipher

which is being created with the key

right here and then you're encrypting it

and writing it out to disk so that's

that encrypted file. write all and

you're writing out those encrypted bytes

um and that is writing out the key as

well so what you'll end up getting is

you'll have an encrypted block of bytes

and you will have the key that is

outputed so that is part one you are

encrypting the file now the second part

basically if you Dro that encrypted file

in the key down to you know a victim you

wouldn't really be able to do much with

it without like directly as decrypting

it with that key um so that's what the

stub is doing so that second part of

code back

here which he has basically broken out

broken it out into two different rust um

code bases what I'm planning on doing is

just kind of combining those and that's

going to be my next contribution in this

open source project um so if we look

over here at the stub this is what is

actually doing this stuff so you've got

an inside VM function here um but you

are creating the infected directory so

this is what is actually running on the

victim by the way this stub is actually

going to be running on the victim so

when you see this is in a VM create the

infected directory establish persistence

things like that um it actually uses the

same persistent persistence mechanism

that I use within my malware that I'm

writing um so it's establishing

persistence and then it is decrypting

the file into PE bytes and it is running

it in a fileless manner so we'll we'll

walk through that here in a bit um so

this decrypt file here actually let's

start there's a better place to start

let's look down here so you're creating

the in the directory here that's where

you're actually just creating the file

or the folders where you're going to you

know do all of this stuff at um you are

grabbing the name of the current

executable let's see let skip down a

little

bit um you're basically here um he's got

a pretty interesting way that I'm going

to steal a little bit um to create a

hidden file or a hidden directory um

which is kind of neat and let's see

establishing persistence like I was

saying this is basically the way that um

he is establishing persistence which is

similar to the way that I'm doing it

within my malware he's using the I

believe he's using a different library

is using win regge um so he's using winr

I'm doing the full like Windows API

calls um winr is probably a better way

to do it but I'm not doing it that way

um so he's establishing persistence by

setting up that registry key within run

um which is the way most malware doesn't

I I would think um and this file less

here is what is actually interesting

fileless uses um MIM exag which is a way

of executing memory directly in memory

instead of executing a file um you have

to use unsafe for that because you're

accessing memory and rust doesn't really

like that very much um so let's see p

bytes equals decrypt file that's going

to be where we do where we're doing all

of the fun stuff um so we we're grabbing

our encrypted bytes right here um now

this is this is the interesting part and

this is the part that I don't really

understand that well which you know kind

of sucks since I'm doing a full

walkthrough of it this is going to be

something that I do a little bit of

research on throughout the rest of the

week rust has a macro that's called

include bytes and basically what include

bytes does is it runs at compile time

and it allows you to include bytes from

another file within the malware itself

and refer or within the program itself

sorry and you can refer to those bites

within the program so what's really

interesting here is that this include

bytes macro runs at compile time to

append the bytes to the end or I believe

yeah I would think it would be to the

end of your executable and then within

the executable at runtime you can refer

to those bites so this is perfect for a

Cryptor because essentially what a stub

Cryptor setup is is you've got the stub

and you've got the included encrypted

bytes and that's you know kind of how

you do everything um so you're call

you're making reference to those

encrypted byes here you are grabbing the

key bytes in the key file which uses the

same included byes here so I believe

technically that does append it to the

end so I was actually wrong there um so

you're actually referring to the

included bytes within key. text um which

are included within the malware itself

and um that's done at compile time like

I said and you are reading those keys

into your key file reference here and

then you're doing the full decryption

now what what this does which is

interesting and I actually like this

approach a lot is all of this happens in

memory so you don't ever actually have

the encrypted biant being written out to

disk which makes it a little bit more

difficult to defend against it because

you know if you've got a an endpoint EDR

so something like a a traditional AV

that scans files that are being written

out to your system they're going to be

able to catch things fairly easily that

are being dropped to desk so if I

dropped a piece of malware straight to

disk that AV is probably going to catch

it fairly easily with this the encrypted

btes are kept in memory they're never

actually written out to disk and then

they are actually run from memory as

well which is what that fileless

function does there at the end so here

we're doing our decryption um block by

block and we are writing it out to the

decrypted bytes object here um so that

is yeah right here so that's that's that

Vector right there you're writing it out

to that Vector um so here we're doing

the actual removal of the padding itself

and you are returning the decrypted

bytes so when we go up here to let's say

decrypt file you're getting those PE

bytes and then you are passing that to

the file less function so if we look at

Function fileless One More Time all

you're doing there is executing that

memory directly instead of writing it

out to file you are executing that

memory directly so this is a really

really good project to look at if you're

trying trying to kind of learn how

cryptors work from a really high level I

actually learned a ton from this

including that include macro that I'm

going to use within my own um Cryptor

that I'm writing that might be kind of a

spoiler but probably within the next

couple of days I'm going to put out a

video on my own Cryptor um I'm going to

call it Scrambler and I'm going to open

source it as well um and that's also the

subject of the research week that I'm

doing within my Discord server if you

become a member of my Discord server you

get access to all of the research weeks

that we're doing this week we're doing

cryptors next week um we're going to

hold a vote on it but it's more than

likely going to be um peer-to-peer

networking within malware which is

always an interesting subject um but

yeah if you're interested you can join

the Discord for free just be a normal

person in the Discord if you want to

become a member $8 a month through sub

I'll leave a link to that as well that's

about it take it easy peace