Hunt.io Adds SSL Certificate Flags to Help Hunt PupyRAT, AsyncRAT and Coyote Infrastructure
Summary
Hunt.io added SSL certificate anomaly flags to its HuntSQL tooling and demonstrates filtering certificate data to identify likely infrastructure linked to PupyRAT, AsyncRAT and Coyote.
Key points
- Hunt.io replaced Go's built-in certificate parser with Google's Certificate Transparency Go library after finding it missed malformed certificates used in PupyRAT infrastructure.
- New HuntSQL flags identify issues including malformed, expired, untrusted or incorrectly configured certificates and TLS usage.
- Filtering for malformed certificate reasons and selected subject fields reduced 1,802 results to 32 servers assessed as likely PupyRAT command-and-control infrastructure.
- For AsyncRAT, filtering a flag for missing digital-signature usage with matching certificate names reduced a broad result set to 128 unique IP addresses.
- For Coyote, filtering certificates flagged for an unknown authority by the subject name “EASport Games” narrowed 33,854,371 results to three servers.
- The examples show that certificate anomalies can support malware infrastructure hunting, but require additional filtering to reduce noise.
Article Details
- Defense Focus
- Hunt for malicious infrastructure by detecting anomalous SSL/TLS certificates and refining certificate searches to reduce false positives.
- Detection Methods
- Search for malformed certificates, including the X.509 error "X509: invalid version" and flags.malformed_reason.
- Detect certificates with missing digital signatures in ephemeral RSA handshakes using flags.rsa_ephemeral_needs_sig.
- Identify certificates signed by unknown authorities using flags.unknown_authority.
- Refine searches with certificate subject and issuer fields, including organizational unit, organization, and common name.
- Data Sources
- SSL/TLS certificate fields and validation results
- X.509 certificate parsing errors
- Certificate subject and issuer attributes
- Rule Types
- HuntSQL queries using SSL certificate anomaly flags and certificate-field filters
- Platforms
- Hunt.io
- Defensive Actions
- Use certificate anomaly flags as hunting pivots, then refine results with suspicious subject and issuer attributes to reduce noise.
- Investigate clusters of servers matching multiple certificate anomalies and family-associated certificate attributes as possible C2 infrastructure.
Malware
AsyncRATAsyncRAT: Abusing Ephemeral RSA HandshakesCoyoteCoyote Banking Trojan: Exploiting SSL Certificate TrustPupyRATOriginally, we used Golang's built-in SSL parser to analyze certificates. But while investigating why PupyRAT-a well-known remote access trojan-was slipping through our data, we realized our SSL parsing had some blind