1. To Catch A Ratter Monitoring the Behaviour of Amateur DarkComet RAT Operators in the Wild
Article by: rown Farinholt, Mohammad Rezaeirad, Paul Pearce, Hitesh Dharmdasani, Haikuo Yin†Stevens Le Blondk, Damon McCoy, Kirill Levchenko
Presented by: Jack Barker

2. Remote Access Trojans
Allows attackers to remotely control an infected machine
Operated manually by a human operator (controller)
Ransomware and botnets are automated in contrast
Webcam / Microphone
Filesystem
Remote desktop
Chat client
Keylogging

3. Remote Access Trojans A target is sent an executable (stub)
When the stub is running, it connects to the controller
The controller then has unrestricted access to the computer
Common theme: accessing a victims computer for personal information
DarkComet is a commercial rat with these features, and is the focus of this piece of research

4. Remote Access Trojans Low barrier of entry Widespread usage
Voyeurism
Sextortion and Blackmail
Surveillance and Espionage
Attacks can be targeted, but often a RAT is sent out to multiple victims/spread online
Common theme: accessing a victims computer for personal information
DarkComet is a commercial rat with these features, and is the focus of this piece of research

5. Motivation
What do rat operators do with the machines they are attacking?
Project Goal: Understand the behaviour of RAT operators in the wild
What do they do with infected machines?
Lots of study on other stuff related to rats
This is the first related to controller behaviour
What features are used the most? What do the attackers want?

6. 01 02 03 04 Methodology Overview Find DarkComet samples
Execute samples in honeypots 02
Record information about how the RATs are used 03
Assess data 04

7. Procuring Fresh Malware
Regularly querying VirusTotal
Up to date set of YARA rules
Can determine where they were uploaded from (mostly Russia and Turkey)
10 new samples on average per hour
19,109 unique DarkComet samples over the course of the study

8. Configuration Extraction
The encryption keys can be extracted from a stub
Communication between controller and stub is encrypted
Password
Version
Campaign ID
List of stub controller IP addresses
Automatically unpacked and information retrieved
8% malformed
18% packed with Mpress or UPX
17,516 of the samples could be unpacked

9. Controller Monitoring
Continuously probe ever known DarkComet controller to determine if it is online
DNS resolution
Determine the IP address of DarkComet controllers with a domain
Resolved hourly
Often used because an operators IP will be changing – operator safety
Targeted scanning
Scans each DarkComet controller every 30 minutes
Addresses taken from configuration extraction
9,877 unique DarkComet controllers

10. Live Operator Monitoring
Two separate ~ two week experiments
Purpose: To monitor the behaviour of DarkComet operators in realistic machines by executing the samples gathered
Samples for operator monitoring were chosen based on a metric which included how old the sample was and whether the controller was active

11. Analysis
52.9 hours connected to controller (out of 2400 machine hours)
Average session lasted 4 minutes (7 minutes when RDP was used)
Webcam Monitoring
Password Theft
File Exfiltration
Audio Capture
Keylogging
Webcam in 61% of trials
Stored passwords in 43% of trials
Filesystem in 40% of trials
Audio capture and keylogging in just over ¼ of attacks
However there was difference seen between sessions which used remote desktop, where 76% of remote desktop sessions attemted to access the webcam compared to only 16% of those who were attacking through the commandline only

12. Analysis Downloading files from honeypot (8%)
Command Line Activity (92 in total)
60% reconnaissance
26% manipulation
10% destruction
Visiting URLS, 123 URLS:
26 adult content
13 gaming
7 blogs
48 unique files dropped
RAT stubs, worms, scripts
Remaining URLS
VPN, search, banking, social, and some 404

13. Analysis Direct Communication 53% harassment 2% extortion
16% misdirection
9% recognition (e.g “HACKED BY #JBAR927”)
Very visible
62% of all operators visible to victim

14. Criticism Only used DarkComet on Windows 7
Other RAT’s could be used differently
Victims with different OS may be attacked differently (e.g Linux)
Honeypots were very restricted in network access
Cuckoo was used to reduce impact of VM
Their analysis of Russia and Turkey could be impacted by VPNs
Some files dropped during sample extraction not analysed
62% of all operators visible to victim

15. Conclusions Method for gathering and extracting stubs devised
Realistic honeypots used to launch stubs into
Cuckoo sandbox used to analyse interaction
Majority of attackers made use of remote desktop and attempted to access the webcam and filesystem
62% of all operators visible to victim