Malware Analysis Using Artificial Intelligence and Deep Learning

Imagine, imagine, if you will, that you're holding a Russian nesting doll, you know, Matriasha. On the outside, it looks totally innocent, maybe a bit decorative painted wood, nothing scary at all. Yeah, but then you crack it open, expecting to find whatever the prize is inside, but instead you just find, well, another doll.

It's identical, just a little smaller exactly.

So you pry that one open, and there's another one, and then another. It isn't until you get three or four layers deep past all these decoys that you actually find the heart of the object.

It's a classic analogy. Yeah, but in the context of what we're covering today, that final object isn't a prize. It's a weapon.

Yeah, a repin Welcome to the deep dive. Today we're unpacking, and I mean literally unpacking, a piece of digital malware that absolutely terrorized the corporate world. We are talking about the Agrigor ransomware Gregor. Yeah, and we aren't just you know, skimming the headlines or reading a Wikipedia summary for you. Today. We're going straight to the source. We are walking looking through a highly technical forensic analysis report from the team at LIFARS.

That's right, The report is titled Malware Analysis Unpacking of Eggregore Ransomware, and unpacking really is the operative word here. The life Fars team actually got their hands on a live sample of eggregor during a real incident response. They didn't just watch it run in a sandbox. They reverse engineered it. They took it apart, bite by bite, layer by layer, just to see what makes it tick.

And what they found reads like a like a detective story where the villain just keeps changing disguises. This isn't your average I clicked a bad link and now my computer is slow kind of virus. This is a high stakes, targeted extortion tool designed to take down absolute giants. So let's just jump right in.

Let's do it.

The analysts get this file, they're ready to see the code. What is the very first thing they notice?

Well, the first surprise is really the format itself. I mean, we are conditioned to think of viruses as executable files, right, like a dot x exactly, virus dot xity. But the sample they were covered was a DLL. Specifically, it was named klang dot dq l LA.

Klang dot dll. Now I know just enough to be dangerous here, But klang is a legitimate compiler, right. It's a tool developers used to write and build code.

It is, and that's exactly why it's such good camouflage. If assistant administrator is just scrolling through a massive list of files on a developer's machine, and they see Clang dot dl.

DBIL, that's probably wouldn't even blink.

It just looks like a standard helper library, right.

It blends right in. But the analysts they didn't just look at the name. They used a tool called Kappa.

Kappa.

Yes, it's a tool that analyzes a file's capabilities, hence the name Kapa, rather than just relying on its signature. It looks at what the code is actively trying to do. And when they ran that Klang dot dl through Kappa, a massive red flag popped up almost immediately.

What was the flag?

The memory permissions. This entirely innocent looking DLL was requesting to allocate memory with RWX.

Protections RWX So that's read write execute correct. Okay, let's unpack this a bit for everyone listening. Why is that specific combination the read, write, and execute such a massive warning sign for security teams Because in modern computing, and specifically in the Windows security architecture. You almost never want a program to be able to write data and execute code in the exact same place, right It's a fundamental security principle called wkret X or write x or execute.

Which is incredibly chaotic.

It's chaotic and it's dangerous. Yeah, but malware loves it. If a program asks for read, write, and execute permission all in one chunk of memory, it almost always means it's preparing to unpack or decrypt a hidden payload and run it right there.

It's basically clearing out a private workspace to build to bomb.

Precisely that rwx slag confirmed the analyst that clig dot Deal wasn't the ransomware itself. It was a loader. Its only job is to smuggle the real malware past the security bouncers, set up a safe space in the computer's memory, and then launch the next stage.

So we are at the very first layer of our mesting doll here. But before this loader even gets to do its job, the report mentioned something really weird. A kill switch, yes, but a very specific one.

Oh, this part is fascinating. While the analysts were looking at the code strings inside the loader, they found a hard coded file path.

What was it?

It was looking for c drive, Python two seven DLLs, Underscore SPCs, ORPA dot pi.

A Python script hiding inside an old Python two point seven folder.

Very specific Python script. Yeah. The malware actually checks to see if this exact file exists on the computer it's currently.

Infecting, and if it does.

If it finds that file, nothing happens. The malware just stops completely. It refuses to run.

Wait, so if I just happen to have a dummy file with that exact name on my computer, I'd be immune.

To eggregor theoretically, yes, you would be.

Why on earth would they build that in? Is it just a programming bug?

No, it's very intentional. It's likely a safety mechanism for the attackers themselves.

Yeah.

To remember, these people are writing, compiling, and testing this highly destructive code on their own machines. Oh right, They do not want to accidentally double click their own creation and encrypt their own hard drives. That would be disastrous for them, so they place this dummy file on their own systems. It effectively acts as it do not detonate.

Sign Wow, it's literally a vaccine for the creator.

That is wild. It is, and it could also be a way to mark specific servers within a victim's network that they want to keep alive. What we mean, well, for example, if they're using a specific compromise server to exltrate gigabytes of data back to their headquarters, they don't want to encrypt that specific server mid heist. It would cut off their own cannet, So they dropped this Python file there to mark that machine as safe.

That shows a level of operational discipline. I really wasn't expecting. It's not just random destruction. It's highly controlled exactly. Okay, So assuming that magic Python file isn't there, the loader proceeds and the report talks about a technique called reflective DLL loading. That sounds incredibly fancy. What does that actually mean for the person trying to stop the attack.

It's a very advanced stealth technique. Traditionally, if you want to run a program, you save the file to the hard drive and you double click it, right, But antivirus software scans the hard drive constantly. It watches every single file that touches the disc. Reflective loading bypasses the hard drive entirely. The malware allocates that RWX memory we talked about earlier, and it manually writes the next stage of the attack directly into the RAM.

So it's like a ghost. It never actually touches the floor. It just floats through the room.

That's a great way to put it. It uses native Windows functions like virtual allock and virtual protect to trick the operating system into treating this blob of raw data in the RAM as a legitimate running program sneaky very and the analysts actually found proof of this happening in the code through a really nerdy detail involving indianness.

Oh indian ness. I love that word. That's about byte ordering, right, like how computers read numbers.

Yes, exactly. It refers to the order of bytes in memory. Some computer architectures read left to right, some read right to left. We call them big Indian and little Indian. Now, every single Windows executable file starts with a standard header marked by two letters M and Z MZ right for Marx s. Pokowski.

You got it. But when the analysts looked at the code in memory, they didn't see MZ. They saw ZM dyslexic malware. No, just the indian ness the bytes were reversed in memory. Seeing ZM and EP instead of MZ and PE confirmed to the analysts that the code was actively parsing a Windows executable header right there in the memory.

It was the smoking gun exactly.

It proved that the ghost was taking a physical form, functionally speaking, inside the ram.

Okay, so they successfully impact this first layer. They've got the ghost in a jar. They look inside fully expecting to find the ransomware, and what do they find instead?

Layer two? Another DLL. This one was named payload one.

Dot D another loader, another loader, but this one had a serious surprise waiting for them. When the analyst tried to run it in a sandbox, which is a safe isolated environment used for automated testing, it just wouldn't run. It just sat there.

Playing dead in a way.

Yeah, yeah, it had a unique lock on it. The analyst discovered that this second DLL checked the command line arguments used to launch it. It was actively looking for a specific parameter starting with dash.

P dash P like for password exactly.

The text following that dash pe wasn't just a random command flag, it was a cryptographic password. If you didn't type the correct password into the command line when launching the malware, the decryption would just fail. The payload would basically scramble itself in the GARB code. It wouldn't detonate.

This totally blows my mind because we usually think of viruses as these automated things, you know, worms that crawl through the network on their own, infecting everything they touch automatically. But this dash pee thing implies a human touch.

That is the crucial takeaway here. This implies a human operator on the keyboard. Greg wor isn't designed to just spread wildly like the flu. It is designed for a highly skilled hacker to break into a network, move around quietly, maybe steal some admin credentials, and then only when they're absolutely ready, they manually tack that password to detonate the ransomware on the target machines.

It's a controlled demolish, it really is.

And it's brilliant for evading security systems. Automated sandboxes don't know the password right, how could they exactly So if an anti virus system grabs this file and tries to run it in a test environment to see if it's malicious, it fails. It looks total harmless. It only becomes a weapon when the thief is standing right there holding the key.

So how did the life team get the password to open it? Did they guess it? You know? Password one, two three?

No, brute forcing high level encryption isn't really feasible in a timeframe like that. They got lucky. The report mentions they obtained the sample from colleagues who were responding to an actual live incident. They likely recovered the password from the command line logs or the memory dumps of a victim's machine where the attackers had already typed it in.

Okay, so they have the password, they type dash P and the secret code. The second layer finally cracks open and inside finally we.

Get to stage three payload two dot DLL. This is the beast. This is the actual Igregor ransomware.

The thing that makes it. Admins want to cry.

Yes, and it is heavy duty. The analysts looked at the encryption capabilities using the windcrypt library in Windows. They found a call to cryptgen key with a parameter size of two thousand and forty eight bits.

Two forty eight bits, that's.

RSA twenty forty eight And the report also notes they used the Chahaw stream cipher for the actual file encryption, which is incredibly fast, so they use both. Basically, they use the super secure RSA key to lock the super fast Chatchat.

Keys, and in plain English for everyone listening.

In plain English, this is military grade encryption. If you don't have the private key held by the attackers, you're not getting your data back. You can't just math your way out of this one.

So once it launches, it just starts locking files. But the report pointed out something really interesting, almost rude, honestly, before it encrypts your files, it goes on a targeted killing spree. It has a hit list of programs it hunts down and terminates.

Right And there's a very specific technical reason for this. In Windows, if a file is open and being actively used by a program, the operating system locks it.

You can't modify it exactly.

You can't change it, and you certainly can't encrypt it. So to ensure absolute maximum damage, the malware has to force close any program that might be holding your valuable data open.

And the list of targets is pretty eclectic. I'm looking at the report details here. It kills sql server, Okay, that makes sense. That's databases. That's the crown jewels for a company, right. It kills Outlook and Thunderbird Okay, email archives, got it. But then it kills Steam.

Yes, Steam and a bunch of other gaming related processes too.

It feels so personal. You're hacking a multinational corporation. Why do you care about Steam?

Well? Context is everything here. Remember that agregor was notoriously used to target major gaming studios.

Ah right.

If you're a game developer, your database isn't just financial spreadsheets, it's the three D game assets, the source code, the project files. All of those are opening your development tools. If the gregor wants to lock those mathsive assets, it has to kill the tools first.

That makes total sense.

So seeing Steam and various game engines on the kill list is a direct reflection of who they were hunting at the time.

It's not just looking for word docs, it's looking for anything valuable to that specific victim. And speaking of killing tools, it doesn't just kill user apps, right, it goes after the cops too, it does.

It explicitly hunts for forensic tools. The report list processes like prochmapron, process monitor, wire shark, specifically dump cap and process.

Explorer, the exact tools an analyst would use.

Yes, these are the tools a security analyst or an incident responder would launch to see what the malware is actually doing on the system.

It's literally blinding the surveillance cameras while it robs.

The bank exactly. It shows that the malware authors fully anticipate a fight. They know security teams will be watching, and they have automated camera measures ready to blind them. The second they try to look.

It's actively fighting back.

That is terrifying.

So the malware runs, the apps closed, the files get locked. You're left with a digital brick. But the encryption is really only half the story with a gregorger, isn't it. The report goes into some os and open source intelligence about what happens next.

This is the massive shift we've seen in the ransomware landscape over the last few years. We call it double extortion. Right. It's no longer just pay us to get your files back. It's pay us or we show everyone your deepest secrets.

The report describes the ransom note directing victims to a dot onion website on the tour network.

The dark web. Correct, and on this site, the attackers maintain what they boldly call a hall of shame.

A hall of shame.

Wow, it's a public dashboard of the companies they have successfully hacked. But it's worse than just a simple list. Next to each company name, they list the percentage of data they have disclosed or leaked so far.

So it's basically a progress bar of humiliation exactly.

It applies immense psychological pressure to the victim. Even if a company has perfect backups and says we don't need to pay you to unlock our files, we can restore them ourselves.

The attackers still have leverage.

The attackers say, fine, but do you want your customer database, your internal emails, and your proprietary trade secrets posted on the open Internet for your competitors to see.

That is absolutely brutal. And the report mentors a specific section of the site called the wh Whole of the Month.

Yes, whole of the month. They really have a twisted sense of humor, they really do. In the timeframe of this specific report, that section featured two very large gaming companies, But there was an incredibly chilling detail added to that entry. The attackers left of ps PostScript warning users to think about possible backdoors in those companies products.

WHOA, let's unpack that for a second. They aren't just saying we stole the source code. They're heavily implying we might have modified the code before we left.

Precisely, if you are a software company, that is an absolute death sentence for your reputation.

Yeah, of course it is.

If your users think your next game update or software patch might contain a virus because the source code was compromised. That destroys trust instantly. And the insidious part is whether the attackers actually planted backdoors or were just bluffing. The thread alone causes massive damage.

It forces the company to basically audit every single line of code before they can release anything ever.

Again, exactly, it's pure psychological warfare. It attacks the brand, not just the server infrastructure. And the report wrapped up by connecting Aggregor to another infamous ransomware.

Family, right, yeah, the Maze ransomware. The analysts noted that Egregre shares a lot of similarities with Maize, particularly in the offustation techniques they used to hide the code.

Maze was huge. They were the ones who essentially pioneered this entire double extortion tactic.

Right and when the Maze group suddenly announced they were shutting down, Eggregor appeared almost immediately after.

It strongly suggests a migration of talent the affiliates, the core developers that they didn't retire, They just rebranded and launched a new product.

A software book date for criminals.

It's a stark reminder that even when law enforcement or the industry defeats one ransomware group, the knowledge and the codebase just evolve into a new form.

It's a hydra. You cut off one head and ag Grigor grows right in its.

Place, exactly and usually the new head is smarter, faster, and much harder to kill.

So let's bring this all back to the start. We began with a nesting ball. We had klang Deal, the camouflage loader allocating that highly suspicious RWX memory inside that payload. One dot Deal the lock box that needed a manual, human typed password to even open, and inside that payload, two dot Deal the rsa encrypted weapon that ruthlessly kills everything from SQL databases to steam.

That is the technical journey. Yes, for you.

Looking at this life fars report as an expert, what is the one thing that really sticks with you? What's the core takeaway you want people to remember?

For me, it has to be that dash pee parameter, the password. Yeah, it represents a fundamental shift in how we have to think about enterprise defense. We aren't just fighting automated dumb scripts anymore. We are fighting intelligent human adversaries who are hands on keyboard.

They're inside the house.

They're navigating our networks, learning our specific systems, figuring out what we value most, and choosing the exact perfect moment to strike. They are manually entering a password to destroy your business. That means our defenses can't just be set and forget automated antivirus, right. We need human threadhunters who can spot that subtle behavior, the lateral movement, the quiet reconnaissance before that password ever gets typed.

That is a very sobering thought. It's not a robot knocking at the door. It's a skilled burglar with a lock pick set who has been quietly living in your attic for.

Two weeks and he already has the keys.

And For me, the thing that sticks out is that image of the Hall of Shame. It reminds us that security isn't just an it problem about keeping the servers running. It's fundamentally about brand reputation. It's about trust.

Absolutely.

When you see Steam listed right next to seql server and a malware kill list, it's a reminder that everything in our networks is connected. Your fun Friday night gaming session and your crucial Monday morning financial reports are all living on the exact same, fragile digital ecosystem.

Well said, the old network parameter is gone. Data is the ultimate asset, and trust is the only currency that matters.

So here is a thought to leave you all with. In the old days, a burglar would break in steal your TV and maybe your jewelry. It was bad, but it was replaceable. A grigor doesn't just steal your diary, it threatens to read it out loud to the entire town square. In a world where data is our most valuable asset, how do you successfully defend against a thief whose most dangerous weapon isn't the encryption itself, but the humiliation?

That is the exact question every CEO and board member needs be asking right now.

Thanks for diving deep with us today. Check your processes, watch out for those stray Python scripts, and definitely stay safe out there, Stay secure,