1. gh0st

2. Example: Gh0stNet

3. GhostNet: Dropper
UPX!
¶üÿÿU‹ìƒìSVW3ÿÿ
Resource Culture Code
0x0804
MZx90
The embedded executable is tagged with Chinese PRC Culture code
This progRy. y cannot be run in DOS mode

4. Link Analysis
“gh0st\”
The web reveals Chinese hacker sites that reference the “gh0st\” artifact

5. Link Analysis
“RESSDT”
A readme file on Kasperky’s site references a Ressdt rootkit.

6. Doc/View is usually MFC
TMC
Rootkit
e:\gh0st\server\sys\i386\RESSDT.pdb
e:\job\gh0st\Release\Loader.pdb
Cgh0stView
Cgh0stDoc
e:\job\gh0st\Release\gh0st.pdb
C:\gh0st3.6_src\HACKER\i386\HACKE.pdb
\gh0st3.6_src\Server\sys\i386\CHENQI.pdb
Dropper
GUI (MFC)
Doc/View is usually MFC
Rootkits
Already at version 3.6

7. gh0st _RAT, source code, team, and forum

8. soysauce

9. Case Study: Chinese APT
2004
2005
2007
2009
2010
SvcHost.DLL.log
SvcHost.DLL.log &
“bind cmd frist!”
SvcHost.DLL.log
Just “bind cmd frist!”

10. Case Study: Chinese APT
2004
2005
2007
2009
2010
XX/XX/2005 – XX:XX PM
12/XX/2007 – X:XX AM
12/XX/2007 – X:XX PM
11/XX/2009 – 9:XX AM
2/XX/2010 – XX:XX AM
12/XX/2009 – 11:XX PM
3/XX/2010 – XX:XX AM
3/XX/2010 – XX:XX PM
Compile times extracted from ‘soysauce’ backdoor program.
3/XX/2010 – XX:XX PM

11. Case Study: Chinese APT
2004
2005
2009
2010
Alters the DLL value of an existing service named “RemoteRegistry”:
Original ServiceDll value: regsvc.dll
Trojan ServiceDll value: regsvr.dll
Registers a service named “IPRIP” which operates as a DLL loaded under svchost.exe
Registers a service named “IPRIP” which operates as a DLL loaded under svchost.exe

12. keylogger

13. Keylogger (link analysis)

14. HBGary’s fingerprint tool

15. The set of Mark Russinovich’s free system tools
The set of Mark Russinovich’s free system tools. You can see which ones are just variants of the same source base, or were compiled on the same platform in or around the same time.

16. system32 directory – Windows 7 64 bit Professional
Old-school DOS command EXE’s
These were very small binaries with almost no fingerprint data
More old school, but these have extra cmd-parsing features
Hypigon
Rebel Base
Virut
Autorun infecting
sysinternals
Language support binaries (NLS)
tskill, tsdiscon, logoff, changelogon, etc
Vobfus
1/41 on virtualtotal
Azero
YahLover
Rungbu

17. HBGary, Inc.

18. HBGary, Inc.

19. HBGary, Inc.