Workshop @ Hack.lu 2019: Reversing WebAssembly Module 101


2019/10/22 @ Hack.lu 2019

WebAssembly (WASM) is a new binary format currently supported by all major web-browsers (Firefox, Chrome, Safari and Edge). WebAssembly module are most commonly compiled from C/C++/Rust source code, loaded and executed inside JS scripts. It is known for being used for malicious purposes like cryptojacking but you will legitimately found usage of WebAssembly inside web-browsers addons, nodejs module or even blockchain smart contracts.

In this workshop, I will first introduce WebAssembly concepts and why it’s consider as a “game changer for the web”. Secondly, I will expose how to analyze a WebAssembly module using different techniques (static & dynamic) as well as some open-source tools that make you the life easier (Octopus, Wasabi, …). Finally, we will hands-on with simple examples/crackmes and finally go throws the analysis of cryptominers.

The following point will be discussed in this workshop.

  1. Introduction
  2. WebAssembly Basics
  3. WebAssembly Runtime VM
  4. Module dissection
  5. Reversing wasm module
  6. Dynamic analysis
  7. Cryptominers
  8. Conclusion

link / slides / repository

Blogpost: Ethereum Threat Actors Part 2 — ClipboardWalletHijacker Malware Still Active.

Ethereum clipboard hijacker malware patrick ventuzelo blogpost quoscient analysis qihoo360 Bitcoin

2019/02/18 @ QuoScient Medium

In part two of our mini-series (see part #1) describing how cybercrime actors are using the Ethereum blockchain for fraudulent means, we analyze a clipboard hijacker malware targeting Bitcoin and Ethereum users. This malware, renamed ClipboardWalletHijacker by Qihoo360 Security Center, was first discovered in June 2018, after having infected 300 thousand computers within a week.

  1. Quick ClipboardWalletHijacker Analysis
  2. Hijacked Ethereum Transactions
  3. Cryptocurrency Exchange Used by the Actor
  4. Packers & Variants
  5. Conclusion
  6. Indicator of Compromise

link / pdf

Blogpost: Ethereum Threat Actors Part 1 — DotNet Downloader using Ethereum Transactions for C&C updates.

Ethereum threat actor botnet transaction tracking patrick ventuzelo QuoScient C&C updates blockchain blogpost dotnet ilspy etherscan bigquery

2019/02/04 @ QuoScient Medium

As part of our research into how cybercrime actors using the Ethereum blockchain for fraudulent means, we analyzed a DotNet downloader that retrieves the malicious payload from URLs stored inside Ethereum transactions. We analyzed the sample provided by a German Security Researcher, Karsten Hahn @struppigel in this tweet.

  1. Downloader analysis
  2. Main Function
  3. GetLastTransactionHashFromAddress function
  4. GetAdditionalDataFromTransaction function
  5. Transaction analysis
  6. C&C Update Pricing
  7. Blockcypher service
  8. Future of Ethereum botnet
  9. Conclusion
  10. Indicators of Compromise

link / pdf