FireEye Malware Intelligence Lab

Flamer/sKyWIper Malware: Analysis

Darien Kindlund — 2012-05-30T05:00:00-07:00

As widely reported elsewhere, the Flamer/sKyWIper malware has largely been attributed to yet another unknown APT actor, which appears to target organizations in the Middle East. Rather than speculate on attribution or repeat the initial analysis provided by CrySyS Lab, this blog post will focus on additional indicators of compromise that have yet to be documented elsewhere.

Even Hackers Don't Like to Work Weekends: Email Attack Trends from Q1 2012

Darien Kindlund — 2012-05-24T09:02:00-07:00

In our second half (2H) of 2011 Advanced Threat Report, we provided compelling evidence that illustrated a possible correlation between an increase in email-based attacks and national holidays. Continuing this theme, let’s widen our dataset to include all worldwide customers and focus on the corresponding statistics collected year-to-date for 2012. To be clear, these statistics reflect the number of malicious attachments seen after initial SPAM and anti-virus filtering across our customer deployments who share intelligence back to us.

Spear phished by FireEye?

FireEye, Inc. — 2012-04-13T07:16:00-07:00

Blogging about crimeware (commodity malware that will infect victims in a purely opportunistic fashion) is an easy thing to do ethically, as the “victim” often times does not add much value to the story. Also, there are so many copies of the malware publicly available that talking about the threat does not compromise your collection source, and in general, we try to avoid “naming names” for the sake of shaming anyone. In the case of crimeware, whether a home user or a chemical company gets compromised by a ddos bot, the malware is going to act pretty much the same. For this reason, publicly talking about those types of threats don’t lead you down discussions of, “But now they now know that you know!” Attacks that are people-driven are much more interesting to analysts because playing against a human leads to a whole different set of challenges than playing against an automated attack algorithm. The attacker, be it APT (China) or simply a well-resourced attacker, performs very systematic attacks on you to see what the simplest method that they need to use in order to be successful is. There is a lot of FUD in the security community about how all APTs use unknown and/or unpatched software vulnerabilities, which is simply false. Why burn a zero-day if a link to an exe/hlp/chm/scr will work just as well? Why use a carefully constructed PDF email attachment that works 5% of the time when you could simply send a link to an older java exploit that works 50% of the time? We’ve seen link lures for “iPhone 5's” and “movie premieres” that work better than the hottest UAV conference. The fact is that there is very much a ramping up of the sophistication of the exploit over the attack timeline between you (or your organization) and a specific threat actor. Obviously, if there is data that needs to be exfiltrated in short order, the volume and sophistication of attacks will escalate faster, but the general “shopping list” with which they are tasked see a very gradual rise until an attack is successful. To put it another way, you’re not always fighting against the A-team, and although the B players aren’t that talented, they are just as relentless.

Quick Reference for Manual Unpacking

Abhishek Singh — 2012-04-09T17:28:10-07:00

By packing their malicious executable, malware authors ensure that, when these malicious executables are opened in a disassembler, these executables do not show the correct sequence of instructions, thus making malware analysis a lengthier and more difficult process. One method to locate the address of the code’s first instruction before it was packed, also known as the Original Entry Point (OEP) of a file, is to apply the breakpoint on the APIs that set up...

Zeus takeover leaves undead remains

Atif Mushtaq — 2012-04-02T22:29:15-07:00

Some of you may be aware that Microsoft this week went after a group of botnets. These botnets were created from the famous Zeus toolkit. This effort was part of so called Operation B-71. When I heard this news, the first thing I wanted to find out was if these botnets have been on FireEye's radar. The answer is yes. Based on data collected from the FireEye MPC (Malware Protection Cloud), we have been detecting...