Drop It Like It's Qbot Separating malicious droppers, loaders, and crypters from their payloads
10SANS Blue Team Summit 2023
Drop It Like It's Qbot: Separating malicious droppers, loaders, and crypters from their payloads for better initial access detection
Speaker: Stef Rand, Intelligence Analyst, Red Canary
This talk will delve into the differences between malware delivery vehicles - droppers, downloaders, and crypters - and their payloads. It's common in the industry to track evil payloads, but less common to nitpick over exactly where the delivery vehicle stop sand the payload starts. Using threat intelligence to identify and track the differences between the two can pay big dividends in early initial access detection. For example, crypters are a type of software used to encrypt, obfuscate, and change evil payloads to make them harder to detect. In this talk you'll hear about one crypter that is used to deliver many threats including Remcos, RedLine, and AsyncRAT. Identifying and tracking this crypter's unique behavior means it can be detected earlier in its infection chain, even before it delivers its payload. You will leave the talk understanding how you can use threat intelligence to help you pinpoint and track malware delivery vehicles, like in the example above. You'll be armed with specific detection opportunities for droppers, loaders, crypters, and current prevalent threats like Qbot. This talk is for a wide audience, from those new to cybersecurity to experienced security analysts.
View upcoming Summits: http://www.sans.org/u/DuS