Original subtitles

1

hello and welcome to this new lesson

2

fingerprinting, it means generating a cryptographic hash value based on the malware content.

3

hashing is meant to verify that a file or piece of data hasn't been altered.

4

fingerprinting uniquely identify a malware sample

5

we'll perform fuzzy hashing to compare files for similarity

6

So, first lets start our windows virtual machine

7

Here we go, first thing I wanna do is visit this site,

8

get the link in web resources

9

on this web page we'll be uploading our binary or malware sample named Rams1, then we'll get its hash value or fingerprinting

10

a hash value coould be generated by different algoritms like: md5, sha1, or sha two five six.

11

so on this site we can get the fingerprinting to our Rams1 binary on any of these three algorithms

12

And of course you can get the fingerprinting from tools like pe studio, so now we're gonna see the hash generated by this tool.

13

don't forget to run in it as administrator

14

now this time I'm gonna use the proyect Rams1, which is a ransomware compiled in c# visual studio

15

so lets get the folder proyect

16

by the way we have an entire section dedicated to ransomware Rams1 later, and you have full acces to source code.

17

here it is our Rams1 proyect

18

visual studio makes this structure directories, and we are looking for our executable in folder bin

19

we see pe studio has generated same three hashes we saw before

20

if you compare these with our online tool, must be the same.

21

same content, same hashes values or fingerprinting.

22

finally let see the hash generated by cff explorer

23

your rather have several tools at hand, although seems redundant

24

your rather have several tools at hand, although seems redundant

25

your analysis will be enriched by combining this info, there we see the hashes.

26

now I'm going to do a demonstration to proof how hashes are unique

27

and they are attached to the content

28

I'll be using visual studio, you don't need to do this you better just watch.

29

What we have here is Rams1 project, I am gonna copy this executable on the desktop

30

and open it in pe studio to expose the hashes

31

What I am gonna do, is a small change in the Rams1 code and see what happened with the hashes

32

so lets open the code, and I'm going to add a class

33

I named the class delete3

34

and now I'll build the executable again

35

there we go

36

and is ready

37

now I'm gonna open the executable I just build in pe studio

38

and now I can compare hashes

39

remember on left we have the binary hashes before, and on the right side, the binary we just modified.

40

they are different because even the small modification causes the hashes to change

41

and that's what fingerprinting technique is for, to id your binary.

42

Now I'm gonna talk to you about fuzzy hashes

43

imagine you have a Rams1 binary and you already got the hash

44

Remember the tinier change in input will output a hash value completely different

45

now the atackers add a new functionalitie to Rams1 and release the malware.

46

now let say you managed to get infected again

47

so the Question is. Are you infected with a new malware?

48

If you compare hashes, it seems two different binaries right?

49

but that doesn't make much sense, because is the same malware with slightly improvement

50

So what you must do is compare these binaries to see how much they alike each other

51

So what you must do is compare these binaries to see how much they alike each other

52

this is a fuzzy comparison, and we have a tool for that, named ssdeep

53

so I'm gonna compile two binaries, one I'll make a small source code change

54

and then will use ssdeep to compare them

55

ok this binary is ready, let's save it

56

ok, now I'm going to add some random class to our project just to change the binarie a little

57

we modified this just a little now compile it and build our new binarie

58

now we got two binaries, let's change the name of this first

59

now I'm gonna copy our two binaries in the same directory our ssdeep tool is

60

ssdeep is a console application I have it ready

61

you'll find this instructions in the tool documentation

62

and as you can see this two binaries are 55% alike

63

so even we changed it, this tool is telling us it is the same malware

64

or at least belong to the same malware family

65

please join me on next lesson to look for strings in our malware sample