Linked Libraries Lab

For this lab you are provided a malware sample that integrates the library Libcurl. Though Libcurl itself is not malicious on its own, many malware families use it to enable network functionality.


Write a generic rule that matches executable files containing Libcurl (such as the Turla malware), but does not match the provided curl.exe or libcurl.dll files.


Zip of samples (password is infected): lab-linkedlibrary.zip

https://drive.google.com/file/d/1IJK3cZghhaLHiehUlKs_myCnE38SQQpB/view?usp=share_link

0010ccb822538d1881c61be874af49382c44b6c9cb665081cf0f672cbed5b6a5 (Turla malware)
04aa05d63e3639f90995afc0e635dad45e57afc858a88ac10ede7c984043c781 (Legitimate curl.exe)
386f29b6f3c568e653ec32ab5107375a19c0b61c0fe7d7a04ce06aae747bdd9f (Legitimate curl-x32.exe)
d40a9aa29bba7359d2db3ad463a0b46c6eefae4ecf0b0deab5c5d13ebc5db2b0 (Legitimate curl-x64.exe)
8982db7aa25341e5dadedfa5097400d57fe8a15773f189b0bc029c5a3c8f40a2 (Legitimate libcurl-x32.dll)
d4b085eb7f59a90872e9cfcde77f6b9ecb886f878f46ce4a499585906fa59ca4 (Legitimate libcurl-x64.dll)

Look at the sample of the Turla malware, and compare the Libcurl usage to the legitimate samples of Curl and Libcurl. What do they have in common, and what is different about them? What logic can help you filter out the legitimate files?


Attempt this lab on your own first, and then review my walkthrough video below to see how I approached it.


Lab Solutions & Walkthrough


Full Rule Solutions

import "pe"
// testing rule
private rule libcurl_string {
    strings:
    $a = "CURL_SSL_BACKEND" 
    condition: 
    uint16be(0)==0x4d5a 
    and $a
}
rule TTP_lib_libcurl_strings {
    meta:
        note = "Looking for PEs contain libcurl stuff (supposing that they use the library) that are NOT curl.exe or libcurl.dll files."
    strings: 
        $a01 = "# Fatal libcurl error"
        $a02 = "# Netscape HTTP Cookie File"
        $a03 = "# https://curl.haxx.se/docs/http-cookies.html"
        $a04 = "# This file was generated by libcurl! Edit at your own risk."
        $a05 = "CURL_SSL_BACKEND"
        $a06 = "CURLOPT_SSLVERSION"
        $a07 = "CURL_SSLVERSION"
        $a08 = "CURL_SSL_BACKEND"
        $a09 = "CURLOPT_RESOLVE"
        //exclusions for curl.exe below
        $z01 = "curl: unknown --write-out variable: '%s'"
        $z02 = "curl: Saved to filename '%s'"
    condition:
        filesize < 3MB
        and uint16be(0) == 0x4d5a
        and pe.number_of_signatures == 0
        and any of ($a*)
        and not any of ($z*)
}
//stuff just in curl.exe

//curl: unknown --write-out variable: '%s'
//curl: (%d) [globbing] %s
//curl: Saved to filename '%s'
//--_curl_--
//curl: try 'curl --help' for more information


//stuff in both libcurl and malware

/*
# Fatal libcurl error
# Netscape HTTP Cookie File
# https://curl.haxx.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.
CURL_SSL_BACKEND
CURLOPT_SSLVERSION
CURL_SSLVERSION
CURL_SSL_BACKEND
CURLOPT_RESOLVE
libcurl/7.56.0-DEV
*/
