Recon 2019 - Defeating APT10 Compiler-level Obfuscation by Takahiro Haruyama

Compiler-level obfuscations like opaque predicates and control flow flattening are starting to be observed in the wild and will be a challenge for malware analysts and researchers. Opaque predicates and control flow flattening are obfuscation methods used to limit malware analysis by defining unused logic, performing needless calculations, and altering code flow so that it is not linear. Manual analysis of malware utilizing these obfuscations is painful and timeconsuming. ANEL (also referred to as UpperCut) is a RAT used by APT10, traditionally targeting Japan. All of the recent ANEL samples are obfuscated with opaque predicates and control flow flattening. In this presentation I will explain how to automatically de-obfuscate the ANEL code by modifying the existing IDA Pro plugin HexRaysDeob. Specifically the following topics will be included. - Disassembler tool internals (IDA Pro IL microcode) - How to define and track opaque predicate patterns for the elimination - How to break control flow flattening while considering various conditional/unconditional jump cases even if it heavily depends on the opaque predicate conditions and has multiple switch dispatchers The modified tool is available publically and this implementation will deobfuscate approximately 89% of encountered functions in the tested sample. This provides researchers with an approach to attack those obfuscations, which could be adopted in additional families. Additional testing and code improvement for this tool will be added prior to the talk. Sharing the experience and knowledge of the implementation with the community will be valuable as threat actors other than APT10 may also start to use the same obfuscations.