Daelano Pacheco: Cool.
Marjorie Furay: Welcome everybody.
Marjorie Furay: To master class.
Marjorie Furay: Today's date is 3 March 16th.
Marjorie Furay: 2023.
Marjorie Furay: And we're happy to start another master class. We will have a short master class this evening with one presentation. I am inviting anybody else to go ahead and do theirs tonight if they want to and not be packed in with the others on the other nights. But that is up to you guys and whoever is ready. In the meantime, I think date Daelano Pacheco, Daelano.
Marjorie Furay: Daelano Pacheco.
Marjorie Furay: Thank you.
Marjorie Furay: Cook Pacheco. Ohh Pacheco.
Daelano Pacheco: That's it. You got it. It's close. Pacheco. Yeah. You know, it's it's close. I got a complicated name. That's why I just go by day. It helps everybody.
Daelano Pacheco: Yeah.
Marjorie Furay: Yeah, yeah, that's cool. Alright. Day. It's all yours.
Daelano Pacheco: Cool. Good deal. Yes. So I'll go ahead and share my screen and begin the presentation.
Marjorie Furay: All righty.
Daelano Pacheco: See.
Daelano Pacheco: Well, hopefully everyone can see that OK.
Daelano Pacheco: Can see my screen OK.
Marjorie Furay: Yes, I can see it. Yep.
Daelano Pacheco: Wonderful.
Daelano Pacheco: All righty, guys. Well, welcome to my presentation on Flare VM. My name is Lana Pacheco, and let's dive in. OK, so this is our agenda for the evening here we have. We're gonna start off the introduction certain features we're going to talk about how to install this thing, tools, sample analysis and finally we'll end with the closing.
Daelano Pacheco: So I'm a little not sure why it keeps.
Daelano Pacheco: Starting without my permission but.
Daelano Pacheco: Well, that's OK. We'll just go through it like this.
Daelano Pacheco: See.
Daelano Pacheco: Right. So.
Daelano Pacheco: Had talked a little bit about what flare VM is, so flare VM is a virtual machine distribution designed for reverse engineering and malware analysis. It is based off of Windows 10. The entire user interface, so it's a little bit easier to manage than some of the other ones. It was created by the Flare team that Mandiant, which is a cyber security company and it is aimed at providing providing an easy to use platform for malware analysis and reverse engineering.
Daelano Pacheco: So who is this made for? You know, when we hear these terms, we want to really ask ourselves, who is this made for? This is made for everyone, but ideally, incident responders, threat intelligence analysts and security reaches. Researchers are gonna be the ones who are using this as those are the people often needing to reverse engineering, analyze programs, reverse engineering, as I mentioned, is the process of examining software and a system to understand its design and function. Malware analysis is the process of examining malicious software to better understand its behavior and purpose, which are both essential for cybersecurity in general.
Daelano Pacheco: So what are some of the benefits? Why would you choose to use flare VM? Well, like I mentioned, it's built on top of the existing Windows 10 system, which is a lot of people are more comfortable and familiar with that contains a wide range of tools for versus engineering and malware analysis. It's customizable to suit the needs of any user. It's free and open source for VM is a strong community of users and contributors behind it and Flare TM, Excuse me. The Flare team provides ongoing support and updates for flare VM on a pretty frequent basis the last.
Daelano Pacheco: Push was about a month ago to their git GitHub.
Daelano Pacheco: So how where do we start with all of this? So we can actually start diving in? Well, it's actually really simple. All you gotta do first is just prepare a Windows 10 virtual machine or VM, Open a PowerShell prompt as administrator in that VM, and then you'll actually run the installation command right there on step #3.
Daelano Pacheco: You'll have to unblock the installation script by running on block file and then the installation. You'll enable that execution and then finally you will execute that script.
Daelano Pacheco: Keep in mind it takes a long time though, so as in depending on your Internet and connection and saying and things it might take a good couple hours. So just be aware of that.
Daelano Pacheco: So what's included? Like what's in the box with this thing? Well, many, many different tools, but some of the more popular ones include ghidra, which is a verse engineering tool that includes disassembler, decompiler and other tools for just analyzing binary code. Floss, which is often referred to as a string analyzer on crack. That's in their documentation, their words, not mine. It's a powerful strings utility that interprets and presents human readable characters found inside of programs. You have Wireshark, which is a network protocol.
Daelano Pacheco: Analyzer does troubleshooting analysis development and then of course you have PE view among many, many others to analyze portable executable files.
Daelano Pacheco: So now we take a look at the sample analysis I have prepared here for this presentation.
Daelano Pacheco: Which is Vidar. So what does Vidar malware, besides sounding like a pretty interesting name? It is an info Steeler information stealer, which is available for purchase based on a malware as a service business model and certain dark web circles so you can purchase this thing. You can configure yourself and then you're able to run it in that sort of fashion instead of doing it yourself. It is written in the C programming language and as the name would suggest, it steals text files containing browser cookies, browser records and.
Daelano Pacheco: All kinds of valuable autofill information. Typically it spreads via spam e-mail campaigns, game hacking clients, malvertising on Google, fake websites, and so many more places.
Daelano Pacheco: So who is targeted by this? Well, Vidar really targets used in Europe, the United States and in certain parts of Canada as well. It focuses on industries such as finance and healthcare and even retail. And the leading idea behind this is that it's because these industries are containing most sensitive kind of information, either financial and personal health information, which is super valuable on dark web marketplaces.
Daelano Pacheco: So here is the general attack chain. Unlike typical mouse from attacks where the malware runs when the user opens the file, visitor actually doesn't do anything until the user closes the file, which is pretty interesting and we'll talk about that here in a moment. As to why the attached DOC file uses visual basics for application or VBA to close and write to two different files in this case, this was Gerta dot VBS and gird dot CMD into program data.
Daelano Pacheco: That Gerta VPS, which will run Kerteh CMD, launch a PowerShell script and it will execute a file called the search to which I don't know if I'm pronouncing that correctly, but is Norwegian for bag two or bag #2 that's downloaded and ran and then from here Vidar will download several different dynamic link library DLL files. They're actually does the stealing of the data provider will grab all the data that it can possibly access, compress it into a zip file and then send it back to a command and control server?
Daelano Pacheco: After sending that data, videos really solid job of completely deleting itself and it's presence from that infected computer.
Daelano Pacheco: And I do have a little note there mentioning that it will use different kinds of sleep commands. Uh, at different intervals to kind of appear a little bit more inactive. You know, we're not really a program we're not malicious over here as what that is trying to is trying to do.
Daelano Pacheco: So if we can look at the static analysis here on the left side, I pulled this from malware bazaar, which is a a sort of just a repository of all kinds of different malware samples. And you know you can analyze them, see the different indicators of compromise with them, etcetera.
Daelano Pacheco: And then on the right, we have virus total which I I really wanted to draw the attention to. You'll notice it has 19 out of 69 detections on it so far. Different vendors had marked that as being malicious, which is not a lot. It's actually relatively little compared to other strains and the fact that it's you know it's been around since March, early of this March.
Daelano Pacheco: You know, it's a little bit bizarre that that would be the case, but this is actually for a number of reasons, right? It uses junk calls, uses, is debugger present functions to kind of behave unexpectedly when a debugger is looking at it. How to use self terminating triggers many different components of it are encrypted. It's packed with a very customized and specialized packing techniques. And it uses anti emulation techniques like scanning for common virtual machine usernames to basically halt.
Daelano Pacheco: It's execution.
Daelano Pacheco: It you also notice here on the left side that it does contain hard coded values that actually contain a different details of targeted applications and data extracted information. So in this case for this particular sample it had different browsers that it was looking for. Opera, Firefox, Chrome, brave. There's few more data steals. So like exactly how is it going to steal these data, these data it's credentials, history, cookies, the wallets that it was looking at here in this case a Bitcoin etherium Z cache and Litecoin was on there as well.
Daelano Pacheco: Just different cryptocurrency wallets and then it will also use details. It'll look for user details like geolocation and system language as well, which is definitely not unique to this particular strain of malware by any means, but it will look for these things and it will try its hardest to evade them. As you can see on the right side there.
Daelano Pacheco: So now we can talk about a moment for the dynamic analysis, which is when we actually had ran the operation, ran the program, and you'll and you'll notice here that it's will detect common virtual machine identifiers. So these are just like the hardware IDs of a system and it will not actually fully execute or establish a connection back to a command and control server as that is harmful to its existence. It's detection is based solely on how stealthy it can be. If it is being detected often or too.
Daelano Pacheco: Quickly it will basically stop its.
Daelano Pacheco: Effectiveness and in order to do that as well, it'll delete some sessions. It'll add a few hexane coded entries to system files and it's really important to note here that Vader is rapidly evolving as it gains more attention. It's been around for quite a while and the more people like myself that analyze it, different sandbox engines analyze it.
Daelano Pacheco: The the less successful it will be in the long run, more creative. The threat actors Van is have to be.
Daelano Pacheco: So you'll notice here on the top that it is sending different kind of get requests to download additional modules that can be used to actually extract those credentials that we mentioned earlier. It'll create files to store that data that's being stolen during the infection.
Daelano Pacheco: And then once that extraction is done, it will create zip file somewhere on the victims machine and store the victims credentials there.
Daelano Pacheco: After doing all of this, it'll terminate all the findings storing, extracting processes that it conducted and actually delete itself.
Daelano Pacheco: And so how do we defend against this? Uh, it it isn't very important to mention that.
Daelano Pacheco: Obviously, when it comes to opening up emails and these all these sort of things, we really want to take necessary precautions. We don't want to download.
Daelano Pacheco: Bizarre odd files from the Internet either that's. That's definitely never a good idea, you know? And it's it's very it's very important to make sure that we're keeping important important files. Excuse me at the common locations. Not common at locations such as desktop documents using strong passwords and enforcing multi factor authentication or possible turning on automatic software updates using routable antiviruses and Internet security software packages wherever possible as well. And like I had mentioned.
Daelano Pacheco: Not opening up on trusted links and e-mail attachments without verifying authenticity. You can do that through various means online. Different sandboxes actually allow you to do that nowadays, and beyond that, just really conducting regular backups and keeping those backups offline or inaccessible to the wider unsafe Internet or on separate networks. Best case scenario.
Daelano Pacheco: And just really bring everything here to a closing flair. BM is a powerful and comprehensive distribution designed to aid those inverse engineering and malware analysis. It does provide preconfigured and just vast platforms for analyzing different kinds of software, all with a wide range of tools and features. Sample Analysis section is present TH in featured, static and dynamic processes of the quickly growing and rapidly evolving Vidar inference Steeler which was made possible on flare VM the static analysis.
Daelano Pacheco: Involved examining them malicious code without actually running it, using tools like X64 DBG and P studio to better identify the functionality and overall behavior.
Daelano Pacheco: The dynamic analysis involved running the malware in a flare bee in the Flavian engine like we talked about to observe its behavior, interactions within the system and of course we used Wireshark to view that outbound traffic.
Daelano Pacheco: And finally, with all that said, are there any questions about this particular?
Daelano Pacheco: Flare VM distribution.
Daelano Pacheco: OK and.
Daelano Pacheco: Take that as no soap. Thank you.
Daelano Pacheco: Oh.
Marjorie Furay: Well, I have. I have. I do have a question.
Daelano Pacheco: Ohh sure.
Marjorie Furay: In what aspect would you be using something like this?
Daelano Pacheco: Absolutely yes. There are many different roles that would require you to manually take a look at a sample of malware, and in the case of where I would see myself using this is, you know, I get a suspicious looking e-mail that is maybe has an attachment with it. I would rather than just taking that and running it through a sandbox. I would actually like to dissect that.
Daelano Pacheco: Program, software, whatever that may be, just so I can better understand it and prepare unique.
Daelano Pacheco: Defenses against that kind of thing. And in this case, we use something called indicators of compromise to do that. These little bits of data artifacts like different hashes, different IP addresses, domain names. If that can be resolved, and we can use that and plug those into different scripting engines like for instance Yara, which stands for yet another ridiculous acronym. But that is a defense engine that actually works based on signatures and rules.
Daelano Pacheco: Which organizations can encompass?
Daelano Pacheco: A wide array of indicators of compromise to basically defend against things, to prevent them from executing on systems to prevent users from being able to connect to those IP addresses in that case etcetera, etcetera, etcetera.
Daelano Pacheco: Hope that answers your question.
Daelano Pacheco: Yeah.
Daelano Pacheco: Yeah. Yeah, so.
Marjorie Furay: Yes, it does. And then who would? Who would use something like this? Is it like all departments on? Is it just crypto? I mean or is it just cyber or is it you know?
Daelano Pacheco: Definitely. I would say that.
Daelano Pacheco: The Cybersecurity Department would be the ones in charge of running this particular operation using flare VM. Different malware analysis tools, primarily because their job is to secure the company security organization, secure everyone inside of it, and this distribution really is key for that. It really is targeted.
Daelano Pacheco: It's it's entire existence is around, just making sure that someone can sit down, some kind of analyst can just sit down, look at all the technical information, see how this could impact the organization. Worst case scenario, and ultimately.
Daelano Pacheco: Preemptively ensure that that doesn't happen using those rules that I like, for instance, that I mentioned earlier. So it's it's really good for that. Like it kind of dwells into the topic of something like thread hunting, right? Where you are proactively or proactively taking steps to prevent.
Daelano Pacheco: The execution of malware vulnerabilities inside of web applications and these sort of things, just the proactive steps you can take to defending the organization before it has a chance to collapse from these kind of attacks.
Marjorie Furay: OK. So any organization can use this, right? It's not anything specific.
Daelano Pacheco: Right, right. Yeah. Any organization can use this. Anyone really can use this. I mean, on top of their existing Windows 10 installation for instance, like it just has all the tools that you need to like, if you saw something come through on your end and you're like, hey, that looks kind of weird. I don't think I should run that rather than taking the risk of like for instance, opening that up or dropping it into a sandbox, you can analyze these things statically so you don't run them.
Daelano Pacheco: You just take a look at what they do.
Daelano Pacheco: I had showcased the tooling here called PE Studio, which actually takes all these indicators from onlines like virus total and places like that and it actually will tell you hey, these different parts of this program are kind of suspicious. These things look kind of malicious. You definitely should not run this program and that's there's an advantage to that. You can really see all the different elements of a piece of software before you take the chance of running it and well.
Daelano Pacheco: Maybe your antivirus didn't catch it. Maybe there is a. It's a new kind of malware that has not yet been recorded. That can be really dangerous if you run that unknown piece of software for whatever reason, you'd really wanna take these steps ahead of time, and this distribution allows you to do that.
Marjorie Furay: That's interesting. That is really interesting.
Marjorie Furay: Yeah.
Daelano Pacheco: Flair VM is awesome. I love it. Really. A lot of people who've ever used, like different kind of malware analysis sandboxes. Or maybe they've used different kinds of distributions like I know there's one for Linux, it's called Remnux, right? Which is it? Just the name of it. But it does a lot of the same things that flare VM does, but in the Linux environment and you know, not everyone maybe wants to use Linux. Maybe that's a little.
Daelano Pacheco: Not maybe that's just not something they feel comfortable with, or maybe that's just not possible at the time. So you know, cuz like for instance, I can think of it not being possible if you had all Windows workstations and maybe reformatting one particular system to be something like remnux and Linux just isn't really in the realm of possibility. So you could just install this distribution on top of that. This flare VM distribution and you have access to all of those tools to analyze everything about a piece of software. So it's.
Daelano Pacheco: Really. I mean, it has a learning curve to it, but it's not a it's like not a steep learning curve because it is on windows and because it's much more familiar to a lot of different kind of people.
Daelano Pacheco: So.
Daelano Pacheco: Right.
Daelano Pacheco: Absolutely.
Daelano Pacheco: Right, yeah.
Marjorie Furay: Right. And if you're familiar with the virtual machine, then you can understand what this is going where this is coming from and that's what's great is that you can use it as a virtual machine and you know, test what it is that you want to say. Just like you're saying this is really.
Marjorie Furay: Tell my students about that.
Daelano Pacheco: Yeah, yeah, yeah. You can segment a lot of your workflow. Maybe you have like a security workflow that's different from your business workflow. You something different from your development workflow and you kind of have like the security station where you have access to all these different kinds of tools. You can, let's say you have them out or like, I don't know spam that's coming in and maybe you want to see maybe establish some kind of attribution for this. You want to see where maybe this is coming from, maybe that's something that you want to have going on that's the like part of your security suite.
Daelano Pacheco: Well, you can you can use flare VM to do that. There's all those all the tools that you need to analyze all the malicious things. You can do it on flare VM and it's just it's a fantastic way to integrate security into your environment without having to sacrifice the comfort or the you know the ease of use that comes from something like Windows. So that's really where it shines. It's easy to use but it's very productive especially for security.
Daelano Pacheco: Reasons. Absolutely.
Daelano Pacheco: Definitely.
Daelano Pacheco: Yeah.
Marjorie Furay: That's that's exciting to check out on something. I'm gonna tell my students something about this. It'd be great.
Daelano Pacheco: Highly recommended.
Marjorie Furay: And Tamara Tamara was saying. So we can use this before we actually get hacked, right?
Daelano Pacheco: Yes. Yeah. So that's actually the most important thing that you'd want to use this for, right? Yeah. It's you would want to take advantage of this software suite to proactively look at things before they have a chance of ever being malicious. Like, like I had mentioned, you know, let's take, for instance, business e-mail compromise, which, as the name suggests, someones e-mail gets taken over. Maybe they had a weak password. Maybe there's a vulnerability that some hackers had exploited well.
Daelano Pacheco: Maybe that person who we would have thought was trusted sends us an e-mail and says, hey, look at this file real quick. Look at this report, whatever it may be, you know, intuition. You'd open that up and maybe you want to look at that and all these sort of things. Well, this entire software suite gives you the tools that you can just very quickly look at that thing and say, oh, you know, in this case that's malicious. What's going on here? You know, something's happening. Whereas if you were just to execute that file, just run that program, you know, it could have been ransomware. It could have been.
Daelano Pacheco: In this case, Vidar writes info Stealer, steals everything, and now you got even way bigger problems on your hands, so it it works in conjunction with all the other security defenses. The security controls that you have in place right now, like antiviruses and maybe different endpoint detections softwares on the macro view of things. And you know you integrate this into that, that entire procedure and it is again it's free, it's open source, you can can configure everything yourself. It's not the most lightweight but.
Daelano Pacheco: It does work on Windows, which is super advantageous for people that maybe are just not familiar with Linux for instance.
Daelano Pacheco: So really great program product.
Marjorie Furay: So are you using this personally yourself right now or with the company?
Daelano Pacheco: Yeah, absolutely. Every day. So I am, I will use a platform, a learning platform like Blue Team Labs Online, which does a lot of defensive and trainings around like just different kind of analysis stuff. So reverse engineering, malware analysis, threat hunting like I mentioned earlier where you go and you practically look for things in different kinds of anomalies, anomalies. Well, I would use flare VM to do that, which is really helpful.
Marjorie Furay: Right, yeah.
Daelano Pacheco: Really breaks down the workflow, makes things easy. I don't have to go install a whole bunch of different tools or mess around different websites that are offering me trial services for the sandboxing, so it makes it all really localized and easy to use. So I do use it. Yeah, all the time.
Daelano Pacheco: And I love it.
Marjorie Furay: That is awesome. Very cool. Well, thank you so much. Did it?
Daelano Pacheco: With you guys, yeah.
Marjorie Furay: Yeah. Does anybody else have any questions at this point?
Marjorie Furay: I.
Sharleen Squires: No questions, but it was a great presentation.
Daelano Pacheco: Oh, that's wonderful. Thank you.
Sharleen Squires: I I I appreciate it. That was like ohh.
Daelano Pacheco: Definitely.
Sharleen Squires: Not to cover something, but yeah.
Daelano Pacheco: Definitely.
Sharleen Squires: Umm.
Marjorie Furay: Yeah. Same thing. Charlie, you're getting ideas now. You're seeing now. Yeah. You gotta come up with something, right?
Marjorie Furay: Well.
Daelano Pacheco: You sure?
Sharleen Squires: I'll call stress, yeah.
Daelano Pacheco: Thanks guys. Appreciate it.
Marjorie Furay: Definitely worth an applause and I think you did a great job and we will have this on PGI pods very soon.
Daelano Pacheco: Sweet.
Marjorie Furay: Umm. And that's great and everybody can't wait to hear yours as well. Next week, whoever's on next week and thank you so much everybody.
Sharleen Squires: Thank you.
Marjorie Furay: Have a great night and weekend.
Tremayne Durham: Thank you. Goodnight.
Daelano Pacheco: Take care, guys. Bye bye.
Sharleen Squires: Bye.