tutorials/notebooks/tbr-files.v0x06.qakbot.decoder.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# The Refinery Files 0x06: Qakbot Decoder\n",
    "\n",
    "This is a short tutorial on how to extract the configuration from an unpacked Qakbot sample.\n",
    "We will be working with the following sample:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "from tutorials import boilerplate as bp\n",
    "bp.store_sample('84669a2a67b9dda566a1d8667b1d40f1ea2e65f06aa80afb6581ca86d56981e7', 'q.bot')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The full pipeline to extract the C2 configuration from this sample is the following.\n",
    "The tutorial will step through each part and explain what is going on."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "------------------------------------------------------------------------------------------------------------------------\n",
      "02.222 kB; 44.01% entropy; ASCII text\n",
      "---------------------------------------------------------------------------------------------------------------[utf8]---\n",
      "181.118.183.103:443\n",
      "92.239.81.124:443\n",
      "174.58.146.57:443\n",
      "73.223.248.31:443\n",
      "86.129.13.178:2222\n",
      "47.34.30.133:443\n",
      "89.216.114.179:443\n",
      "41.44.11.227:995\n",
      "66.180.227.170:2222\n",
      "46.229.194.17:443\n",
      "------------------------------------------------------------------------------------------------------------------------\n"
     ]
    }
   ],
   "source": [
    "%%emit q.bot [[\n",
    "        | put backup [\n",
    "            | rex yara:5168([4])BA([2]0000)B9([4])E8 {1}{3}{2}\n",
    "            | struct {ka:L}{da:L}{dl:L}\n",
    "            | put key vsnip[ka:128]:var:backup\n",
    "            | emit vsnip[da:dl]:var:backup \n",
    "            | xor var:key ]\n",
    "        | resplit h:00 \n",
    "        | swap key\n",
    "        | swap backup\n",
    "        | perc RCDATA [| max size ]\n",
    "        | rc4 sha1:var:key\n",
    "        | put required x::20\n",
    "        | put computed sha1:c:\n",
    "        | iff required -eq computed\n",
    "        | rc4 x::20 \n",
    "        | snip 20:\n",
    "        | rex '(\\x01.{7})+' ]\n",
    "    | struct -m !xBBBBHx {1}.{2}.{3}.{4}:{5} [| sep ]\n",
    "    | peek -d ]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Configuration Resource Format\n",
    "\n",
    "Qakbot contains two configuration resources which are doubly encrypted with RC4:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "------------------------------------------------------------------------------------------------------------------------\n",
      "01.020 kB; 97.77% entropy; data\n",
      "    lcid = Neutral Locale Language\n",
      "  offset = 0x2878C\n",
      "    path = RCDATA/3C91E539/0\n",
      "------------------------------------------------------------------------------------------------------------------------\n",
      "00000: 32 16 4A 40 17 69 8D CB 73 9A 6B D7 86 C7 06 0F 2A 5C 16 EE E4 12 7E 3E 56 5D BB C7  2.J@.i..s.k.....*\\....~>V]..\n",
      "0001C: 5E 42 C9 E2 23 D5 98 74 57 62 89 7B 19 1F 90 35 BD 6B 10 47 71 F9 76 0E E6 CE 84 22  ^B..#..tWb.{...5.k.Gq.v....\"\n",
      "------------------------------------------------------------------------------------------------------------------------\n",
      "00.083 kB; 75.02% entropy; data\n",
      "    lcid = Neutral Locale Language\n",
      "  offset = 0x28B88\n",
      "    path = RCDATA/89290AF9/0\n",
      "------------------------------------------------------------------------------------------------------------------------\n",
      "00000: 64 2D C5 1A 99 AF E3 A4 23 2D 1C 72 57 74 97 E5 4C EC C0 53 CF 6F B6 B8 B4 E2 00 DB  d-......#-.rWt..L..S.o......\n",
      "0001C: 1E 64 81 91 71 AD 39 2A EE 88 86 5D 84 04 A9 67 2D 99 20 CE 14 CF 4F B7 38 6E 61 3F  .d..q.9*...]...g-.....O.8na?\n",
      "------------------------------------------------------------------------------------------------------------------------\n"
     ]
    }
   ],
   "source": [
    "%emit q.bot | perc RCDATA [| peek -l2 ]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The key in this sample is derived from the following secret:\n",
    "```\n",
    "bUdiuy81gYguty@4frdRdpfko(eKmudeuMncueaN\n",
    "```\n",
    "The key derivation is a single round of SHA1. After decrypting the resources with the derived key, the data is in the format\n",
    "```\n",
    "[checksum][key2][data]\n",
    "```\n",
    "where `[checksum]` is the SHA1 hash of `[key2][data]`, and `[key2]` is the RC4 key for the second decryption layer.\n",
    "There are some Qakbot variants where the format of this second layer is different and the second decoding step has to work differently,\n",
    "but the purpose of this tutorial is not to be comprehensive Qakbot overview, but rather a demonstration of how you can build configuration decoders in refinery. We will therefore assume that we are only dealing with samples that use the aforementioned format.\n",
    "When the secret is known, decrypting the resources is straightforward:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "------------------------------------------------------------------------------------------------------------------------\n",
      "00.960 kB; 72.57% entropy; data\n",
      "    lcid = Neutral Locale Language\n",
      "  offset = 0x2878C\n",
      "    path = RCDATA/3C91E539/0\n",
      "------------------------------------------------------------------------------------------------------------------------\n",
      "00000: 01 B5 76 B7 67 01 BB 00 01 5C EF 51 7C 01 BB 01 01 AE 3A 92 39 01 BB 00 01 49 DF F8  ..v.g....\\.Q|.....:.9....I..\n",
      "0001C: 1F 01 BB 00 01 56 81 0D B2 08 AE 00 01 2F 22 1E 85 01 BB 00 01 59 D8 72 B3 01 BB 00  .....V......./\"......Y.r....\n",
      "00038: 01 29 2C 0B E3 03 E3 01 01 42 B4 E3 AA 08 AE 00 01 2E E5 C2 11 01 BB 00 01 BE 4A F8  .),......B................J.\n",
      "00054: 88 01 BB 01 01 58 7A D0 C5 7D 64 00 01 4E A1 26 F2 01 BB 01 01 59 73 C4 63 01 BB 00  .....Xz..}d..N.&.....Ys.c...\n",
      "00070: 01 AE 00 E0 D6 01 BB 01 01 AF CD 02 36 01 BB 01 01 88 E8 B8 86 03 E3 01 01 D5 C2 EA  ............6...............\n",
      "0008C: 4B 03 E3 00 01 69 9A 70 4D 01 BB 00 01 AE 68 B8 95 01 BB 01 01 5E 3C 8D 30 03 E3 01  K....i.pM.....h......^<.0...\n",
      "000A8: 01 6D 9F 77 A2 08 AE 00 01 55 F1 B4 5E 01 BB 01 01 C5 01 FC 60 03 E3 00 01 40 CF ED  .m.w.....U..^.......`....@..\n",
      "000C4: 76 01 BB 01 01 90 CA 0F 3A 01 BB 01 01 4A 21 54 E3 01 BB 01 01 56 E1 D6 8A 08 AE 00  v.......:....J!T.....V......\n",
      "000E0: 01 2D 31 89 50 01 BB 01 01 5C 18 C8 E2 03 E3 00 01 4A 5C F3 71 03 E3 01 01 4C 44 22  .-1.P....\\.......J\\.q....LD\"\n",
      "000FC: A7 08 AE 01 01 1B 21 ED 69 01 BB 00 01 C9 C0 B3 DD 01 BB 00 01 9A F7 0F AD 03 DE 00  ......!.i...................\n",
      "------------------------------------------------------------------------------------------------------------------------\n",
      "00.023 kB; 42.68% entropy; diff output, ASCII text, with CRLF line terminators\n",
      "    lcid = Neutral Locale Language\n",
      "  offset = 0x28B88\n",
      "    path = RCDATA/89290AF9/0\n",
      "---------------------------------------------------------------------------------------------------------------[utf8]---\n",
      "10=BB05\n",
      "3=1667470564\n",
      "------------------------------------------------------------------------------------------------------------------------\n"
     ]
    }
   ],
   "source": [
    "%%emit q.bot [\n",
    "    | perc RCDATA\n",
    "    | rc4 sha1:bUdiuy81gYguty@4frdRdpfko(eKmudeuMncueaN\n",
    "    | snip 20:\n",
    "    | rc4 x::20\n",
    "    | snip 20:\n",
    "    | peek -d ]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The large resource contains entries of the following form, where each cell represents a byte:\n",
    "```\n",
    "    0   1   2   3   4   5   6   7   8\n",
    "    .---.---.---.---.---.---.---.---.\n",
    "    | A |   IP ADDRESS  |  PORT | B |\n",
    "    '---'---'---'---'---'---'---'---'\n",
    "```\n",
    "The byte `A` specifies the C2 type. If its value is `1`, then the C2 entry is an IPv4 address. A value of `2` indicates an IPv6 entry type `3` is some unknown 20 byte long entry. The end byte `B` is an identifier for an internal priority list. Since we are currently observing only IPv4 C2s in Qakbot, we will restrict to parsing out those. To reduce the risk that this pipeline extracts junk from future samples, we use the regular expression `(\\x01.{7})+` to filter the C2 buffer down to only IPv4 type entries:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "------------------------------------------------------------------------------------------------------------------------\n",
      "02.222 kB; 44.01% entropy; ASCII text\n",
      "---------------------------------------------------------------------------------------------------------------[utf8]---\n",
      "181.118.183.103:443\n",
      "92.239.81.124:443\n",
      "174.58.146.57:443\n",
      "73.223.248.31:443\n",
      "86.129.13.178:2222\n",
      "47.34.30.133:443\n",
      "89.216.114.179:443\n",
      "41.44.11.227:995\n",
      "66.180.227.170:2222\n",
      "46.229.194.17:443\n",
      "------------------------------------------------------------------------------------------------------------------------\n"
     ]
    }
   ],
   "source": [
    "%%emit q.bot [[\n",
    "        | perc RCDATA\n",
    "        | rc4 sha1:bUdiuy81gYguty@4frdRdpfko(eKmudeuMncueaN\n",
    "        | snip 20:\n",
    "        | rc4 x::20\n",
    "        | snip 20:\n",
    "        | rex '(\\x01.{7})+' ]\n",
    "    | struct -m !xBBBBHx {1}.{2}.{3}.{4}:{5} [| sep ]\n",
    "    | peek -d ]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The [struct][] command might need a little explanation here: With the `-m` switch, the unit will not parse a single struct, but multiple subsequent structs. Each struct is requested to have the format `!xBBBBHx`; the exclamation mark `!` [specifies big endian byte order][struct-byte-order-size-and-alignment] and the remaining characters extract a C2 record using [struct format characters][struct-format-characters]. The second (and optional) argument of [struct][] is a format string expression that can be used to format parsed data. In this case, the format expression `{1}.{2}.{3}.{4}:{5}` will print the four ocets of the parsed IPv4 address separated by dots, and add the port value separated by a colon.\n",
    "\n",
    "[struct-byte-order-size-and-alignment]: https://docs.python.org/3/library/struct.html#byte-order-size-and-alignment\n",
    "[struct-format-characters]: https://docs.python.org/3/library/struct.html#format-characters\n",
    "[struct]: https://binref.github.io/#refinery.struct"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Decrypting The Strings\n",
    "\n",
    "The previous section explains the bottom part of the full pipeline, namely how to parse and format the configuration resource once it has been decrypted. In order to decrypt the resource, we need the key. The key is stored as an encrypted string, and so we'll have to decrypt those. After some reversing, you notice that the decryption of the string table follows the following opcode pattern:\n",
    "```\n",
    "  51                 PUSH  ECX\n",
    "  51                 PUSH  ECX\n",
    "  68 50 F0 0E 00     PUSH  TABLE_DECRYPTION_KEY\n",
    "  BA B1 05 00 00     MOV   EDX, 0x5b1\n",
    "  B9 D8 F0 0E 00     MOV   ECX, TABLE_ENCRYPTED_DATA\n",
    "  E8 98 7F 00 00     CALL  _DECRYPT\n",
    "  83 C4 0C           ADD   ESP, 0xc\n",
    "  C3                 RET\n",
    "```\n",
    "This converts to the following [yara][]-esque pattern:\n",
    "```\n",
    "  51 68 [4] BA [2]0000 B9 [4] E8\n",
    "```\n",
    "The regular expression argument for the [rex][] unit has a special [yara handler][yara-handler] which can be useful to convert the above type of pattern into a regular expression (it saves you a bunch of `\\x`); we put capture group parentheses around the address of the table decryption key, the size of the table, and the address of the encrypted table data:\n",
    "```\n",
    "  5168([4])BA([2]0000)B9([4])E8\n",
    "```\n",
    "We then run [rex][] as follows:\n",
    "```\n",
    "  rex yara:5168([4])BA([2]0000)B9([4])E8 {1}{3}{2}\n",
    "```\n",
    "This will search for a regular expression matching the above opcode pattern, and the format string `{1}{3}{2}` as the second argument means that each match found by [rex][] will lead to one output chunk that contains, in this order:\n",
    "1. the bytes that constitute the table decryption key address\n",
    "2. the bytes that constitute the table data address\n",
    "3. the lower two bytes of the little-endian integer containing the table size\n",
    "\n",
    "We can compose this unit with [struct][] to extract each of these values as an integer meta variable into the current chunk:\n",
    "\n",
    "[yara]: https://yara.readthedocs.io/en/stable/index.html\n",
    "[rex]: https://binref.github.io/#refinery.rex\n",
    "[struct]: https://binref.github.io/#refinery.struct\n",
    "[yara-handler]: https://binref.github.io/lib/argformats.html#refinery.lib.argformats.DelayedRegexpArgument.yara"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "------------------------------------------------------------------------------------------------------------------------\n",
      "      da = 0xEF0D8\n",
      "      dl = 0x5B1\n",
      "      ka = 0xEF050\n",
      "  offset = 0x1081\n",
      "------------------------------------------------------------------------------------------------------------------------\n",
      "      da = 0xEF7A8\n",
      "      dl = 0x1107\n",
      "      ka = 0xEF720\n",
      "  offset = 0xA9C8\n",
      "------------------------------------------------------------------------------------------------------------------------\n"
     ]
    }
   ],
   "source": [
    "%%emit q.bot [\n",
    "    | rex yara:5168([4])BA([2]0000)B9([4])E8 {1}{3}{2}\n",
    "    | struct {ka:L}{da:L}{dl:L}\n",
    "    | peek -l0 ]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "After having extracted those addresses, we would like to first extract the key, and then extract the table data to then decrypt it with the key. \n",
    "\n",
    "- First, we will use [put][] to store the input data in a meta variable called `backup`. \n",
    "- Then, we use the above pipeline to populate the variables that contain all the necessary addresses and sizes. \n",
    "- Next, we use [put][] again to populate a variable named `key` with the key bytes. This is done by using the [multibin expression][multibins] `vsnip[ka:128]:var:backup` which first uses the [var handler][var-handler] to extract the contents of `backup`, and then obtains the result of piping that data to the [vsnip][] unit with the argument `ka:128`, which will extract `128` bytes from the input executable, starting that the offset that corresponds to the virtual address `ka`. In this case, it will be the decryption key.\n",
    "- We then [emit][] the contents of another [multibin expression][multibins], this time extracting the contents of the encrypted table.\n",
    "- Finally, we use [xor][] to decrypt the string table with the key that is stored in the meta variable `key`.\n",
    "\n",
    "The result will be two buffers of strings separated by null bytes. We use [resplit][] to split, and for the sake of not flooding this notebook, we only [pick][] the first 10 of the decrypted strings and have a [peek][]:\n",
    "\n",
    "[emit]: https://binref.github.io/#refinery.emit\n",
    "[put]: https://binref.github.io/#refinery.put\n",
    "[pick]: https://binref.github.io/#refinery.pick\n",
    "[peek]: https://binref.github.io/#refinery.peek\n",
    "[resplit]: https://binref.github.io/#refinery.resplit\n",
    "[xor]: https://binref.github.io/#refinery.xor\n",
    "[vsnip]: https://binref.github.io/#refinery.vsnip\n",
    "[multibins]: https://binref.github.io/lib/argformats.html\n",
    "[var-handler]: https://binref.github.io/lib/argformats.html#refinery.lib.argformats.DelayedArgument.var"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "00.011 kB: ProgramData\n",
      "00.072 kB: ERROR: GetModuleFileNameW() failed with error: ERROR_INSUFFICIENT_BUFFER\n",
      "00.081 kB: schtasks.exe /Create /RU \"NT AUTHORITY\\\\SYSTEM\" /SC ONSTART /TN %u /TR \"%s\" /NP /F\n",
      "00.011 kB: route print\n",
      "00.033 kB: powershell.exe -encodedCommand %S\n",
      "00.040 kB: bUdiuy81gYguty@4frdRdpfko(eKmudeuMncueaN\n",
      "00.056 kB: SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\ProfileList\n",
      "00.065 kB:  /c ping.exe -n 6 127.0.0.1 &  type \"%s\\\\System32\\\\calc.exe\" > \"%s\"\n",
      "00.009 kB: net share\n",
      "00.033 kB: nltest /domain_trusts /all_trusts\n"
     ]
    }
   ],
   "source": [
    "%%emit q.bot [\n",
    "        | put backup [\n",
    "            | rex yara:5168([4])BA([2]0000)B9([4])E8 {1}{3}{2}\n",
    "            | struct {ka:L}{da:L}{dl:L}\n",
    "            | put key vsnip[ka:128]:var:backup\n",
    "            | emit vsnip[da:dl]:var:backup \n",
    "            | xor var:key ]\n",
    "    | resplit h:00 \n",
    "    | pick :10\n",
    "    | peek -be ]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Finding The Key\n",
    "\n",
    "We are able to decrypt the strings, and we know that one of those strings is the decryption key. How to find the right one? Brute force, obviously. We will simply try to decrypt the configuration resource with every single string we find, and fortunately, the Qakbot authors provided us with a straightforward way to check whether a decryption result is valid: The first 20 bytes are a SHA1 checksum of the remaining contents. This will give us the final Qakbot config extraction pipeline. Have another look, you should already recognize some components:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "------------------------------------------------------------------------------------------------------------------------\n",
      "02.222 kB; 44.01% entropy; ASCII text\n",
      "---------------------------------------------------------------------------------------------------------------[utf8]---\n",
      "181.118.183.103:443\n",
      "92.239.81.124:443\n",
      "174.58.146.57:443\n",
      "73.223.248.31:443\n",
      "86.129.13.178:2222\n",
      "47.34.30.133:443\n",
      "89.216.114.179:443\n",
      "41.44.11.227:995\n",
      "66.180.227.170:2222\n",
      "46.229.194.17:443\n",
      "------------------------------------------------------------------------------------------------------------------------\n"
     ]
    }
   ],
   "source": [
    "%%emit q.bot [[\n",
    "        | put backup [\n",
    "            | rex yara:5168([4])BA([2]0000)B9([4])E8 {1}{3}{2}\n",
    "            | struct {ka:L}{da:L}{dl:L}\n",
    "            | put key vsnip[ka:128]:var:backup\n",
    "            | emit vsnip[da:dl]:var:backup \n",
    "            | xor var:key ]\n",
    "        | resplit h:00 \n",
    "        | swap key\n",
    "        | swap backup\n",
    "        | perc RCDATA [| max size ]\n",
    "        | rc4 sha1:var:key\n",
    "        | put required x::20\n",
    "        | put computed sha1:c:\n",
    "        | iff required -eq computed\n",
    "        | rc4 x::20 \n",
    "        | snip 20:\n",
    "        | rex '(\\x01.{7})+' ]\n",
    "    | struct -m !xBBBBHx {1}.{2}.{3}.{4}:{5} [| sep ]\n",
    "    | peek -d ]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now after extracting all the strings, each chunk in the frame contains a potential key. We use [swap][] to move this data into a variable called `key`. After this operation, the chunk body is empty. We use [swap][] again to move the contents of the previously populated `backup` variable back into the chunk body so we can use [perc][] and [max][] to extract the larger of the two configuration resources. Afterwards, we use [rc4][] to attempt decryption with the current `key`. We then compute two variables `required` and `computed`, one containing the first 20 bytes of the chunk and the other containing the SHA1 hash of the remaining bytes. The [iff][] unit allows us to filter out all chunks where the two values are not the same.\n",
    "\n",
    "After this, the only chunk that should remain is the decrypted config blob, which we can parse out as before.\n",
    "\n",
    "[swap]: https://binref.github.io/#refinery.swap\n",
    "[perc]: https://binref.github.io/#refinery.perc\n",
    "[max]: https://binref.github.io/#refinery.max\n",
    "[iff]: https://binref.github.io/#refinery.iff\n",
    "[rc4]: https://binref.github.io/#refinery.rc4"
   ]
  }
 ],
 "metadata": {
  "interpreter": {
   "hash": "4bb4b02bf57a2c25456a741474d02d2de926aec3c451f22b312ec34f66909bb4"
  },
  "kernelspec": {
   "display_name": "Python 3.9.7 64-bit (system)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.12.6"
  },
  "orig_nbformat": 4
 },
 "nbformat": 4,
 "nbformat_minor": 2
}