---
# System prepended metadata

title: 'HITCON 101 - BackSwap InfinityWar-Deep Dive Analysis of Banking Trojan / IokJin Sih, KunYu Chen'
tags: [HITCONCMT, HITCON, HITCONCMT2019]

---

HITCON 101 - BackSwap InfinityWar-Deep Dive Analysis of Banking Trojan / IokJin Sih, KunYu Chen
===


BackSwap intro 
Online Banking Trojan shown since 2018 


Step1 -SetWinEventHook()
listen the browser 

Step2 - Using API to get the browser URL 

Step3 - JavaScript Injection 

Step4 - 惡意javascript 干擾數位

Basic Information 
file name - fake-7zip.exe

Perpartion - War 1 
-Peel off the Shellcode 
-find the hidden Shellcode , that's hidden in 7-Zip 
Using Shellcode Loader to load Backswap 
shellcode in program 


5 Steps to peel off the shellcode 

1.BackSwap loader locate
initterm() 


2. VirtualAlloc() 
    find the call ds:VirtualAlloc 
    
3.Shellcode ram locate 


5.hook api
   監控url
   於瀏覽器開發者工具輸入惡意javascript 模擬人員操作


API Hashing 
-API Hash -> OS DLL Ram location 
0xFBEDE6FE-> user32.dll:SetWinEventHock()
0xBE815D52-> ntdll.dll: NtdllDefWindowProc_A()
0x03C35711->user32.dll:EnableWindow()


API Hash Table 

input:DLL >Hash handling > Output Hash 
SetWinEventHook              0xFBEDE6FE





###### tags: `HITCONCMT2019`,`HITCONCMT`,`HITCON`