We found the full CARBANAK source code & previously unseen plugins.
Our #FLARE team spent 500 hours analyzing the 100,000+ lines of code.
@mykill & @jtbennettjr just dropped day 1 of their 4-part blog series: fireeye.com/blog/threat-reβ¦
Source code linked in blog. #CarbanakWeek π¦π³
- We found the full CARBANAK source code & previously unseen plugins. Our #FLARE team spent 500 hours analyzing the 100,000+ lines of code. @mykill & @jtbennettjr just dropped day 1 of their 4-part blog series: fireeye.com/blog/threat-reβ¦ Source code linked in blog. #CarbanakWeek π¦π³
I have to admit, this @virustotal find is going to be hard for me to top. This CARBANAK work was in active development when whoopsed to VT π€·π»ββοΈ from RU π·πΊ on 2017-04-19. kb3r1p.rar 879 files (15.03 MB) virustotal.com/#/file/783b2eeβ¦ apwmie.rar 24 files (5.93 MB) virustotal.com/#/file/4116ec1β¦For those without @virustotal, how about @virusbay_io sharing? Now you can play alongside the blog with #CarbanakWeek: Home Malware Edition kb3r1p.rar 06efd1354b7418198c66a78ff3e68e59 beta.virusbay.io/sample/browse/β¦ apwmie.rar 2549f116adbbfeeecf7596e6381bb43c beta.virusbay.io/sample/browse/β¦GIFKudos to anyone else who found the source code! We sat on it for ~2 years [pictured] π€ - that seemed like enough. @FireEye got a LOT out of this access/analysis, like that time #FLARE modified #CARBANAK's video player to support FIN7βs custom encoding: fireeye.com/blog/threat-reβ¦- Dropping π»π₯ as FLARE's #CARBANAKweek continues Part 2β£ (of 4): fireeye.com/blog/threat-reβ¦ β’ 2 AV vendor evasions that @FireEye responsibly disclosed - π£οΈ @nopandroll β’ Attacker toolmarks, infrastructure, & passwords π΅π»ββοΈ β’ Survey of exploits FOLLOW: @jtbennettjr & @mykillFLARE's #CARBANAKweek Part 3β£ (of 4): fireeye.com/blog/threat-reβ¦ ππ¨βπ»π₯ "If Bruce Lee had been a malware analyst, he might have said that source code is like a finger pointing away to the moon; donβt concentrate on the finger, or you will miss all that binary ground truth."Did @FireEye use knowledge of the source code to patch #CARBANAK's video player and possibly even catch #FIN7's front company Combi Security monitoring unwitting "red teamer" employees? MAYBE?? π₯π₯ Read part 4οΈβ£ (the conclusion) of #CARBANAKweek π³π¦: fireeye.com/blog/threat-reβ¦
- Tom & Michael are going to release the technical details throughout this #Carbanak week, but if you want a preview of what they found, @cglyer and I hung out with them on #StateOfTheHack a few months ago youtu.be/gDZb4Hr8w_II'm proposing we extend this week's blog series into the #Carbanak Weekend. The Internet deserves a deeper exploration of Carbanak GUI design choices. fireeye.com/blog/threat-reβ¦
Have you seen any specific part of the code for capturing PIN code from smart-card readers/drivers?
