# TLS Certificate Analysis for Malware

Guide to analyzing TLS certificates and handshakes for malware identification,
including JA3/JA3S fingerprinting and certificate anomaly detection.

## TLS Handshake Overview

The TLS handshake provides multiple analysis opportunities:

1. **ClientHello**: Reveals client TLS fingerprint (JA3), supported versions, cipher suites
2. **ServerHello**: Reveals server TLS fingerprint (JA3S), chosen cipher suite
3. **Certificate**: Server certificate with issuer, subject, validity, and extensions
4. **SNI Extension**: Requested hostname (in ClientHello)

---

## JA3 Fingerprinting

JA3 creates a fingerprint of a TLS client based on the ClientHello message.
Malware often has unique JA3 hashes because it uses specific TLS libraries or
configurations different from standard browsers.

### How JA3 Works

JA3 concatenates these ClientHello fields:
- TLS version
- Cipher suites
- Extensions
- Elliptic curves
- Elliptic curve point formats

Then takes the MD5 hash of the result.

### Extracting JA3 with tshark

```bash
# JA3 hashes (requires tshark 3.x+)
tshark -r capture.pcap -Y "tls.handshake.type==1" -T fields \
    -e ip.src -e ip.dst -e tls.handshake.ja3

# JA3S hashes (server fingerprint)
tshark -r capture.pcap -Y "tls.handshake.type==2" -T fields \
    -e ip.src -e ip.dst -e tls.handshake.ja3s

# JA3 with SNI for context
tshark -r capture.pcap -Y "tls.handshake.type==1" -T fields \
    -e ip.src -e tls.handshake.extensions_server_name -e tls.handshake.ja3
```

### Known Malicious JA3 Hashes

Note: JA3 hashes should be used as one indicator among many, not as sole evidence.
These are examples of commonly reported malicious JA3 fingerprints:

| JA3 Hash | Associated Tool/Malware |
|----------|------------------------|
| `a0e9f5d64349fb13191bc781f81f42e1` | Cobalt Strike (default) |
| `72a589da586844d7f0818ce684948eea` | Metasploit Meterpreter |
| `e7d705a3286e19ea42f587b344ee6865` | Trickbot |
| `6734f37431670b3ab4292b8f60f29984` | AsyncRAT |
| `51c64c77e60f3980eea90869b68c58a8` | Python requests library |

### JA3 Lookup Resources

- ja3er.com: Database of JA3 fingerprints
- Salesforce JA3 repository: Reference implementation and hash database
- JARM: Active TLS fingerprinting (server-side)

---

## Certificate Analysis

### Extracting Certificates

```bash
# Certificate details with tshark
tshark -r capture.pcap -Y "tls.handshake.certificate" -T fields \
    -e ip.src -e ip.dst \
    -e x509af.serialNumber \
    -e x509ce.dNSName \
    -e x509af.validity.notBefore \
    -e x509af.validity.notAfter \
    -e x509af.issuer.rdnSequence

# Export certificates for detailed analysis
tshark -r capture.pcap -Y "tls.handshake.certificate" \
    --export-objects tls,./certs/
```

### Wireshark Certificate Inspection

1. Filter: `tls.handshake.type == 11`
2. Expand the certificate in the packet details
3. Check: Issuer, Subject, Validity, Extensions, Serial Number

### Suspicious Certificate Indicators

| Indicator | What to Check | Severity |
|-----------|---------------|----------|
| Self-signed | Issuer == Subject | Medium-High |
| Short validity | Valid for <30 days | Medium |
| Long validity | Valid for >10 years | Medium |
| Missing organization | Empty Org/OU fields | Medium |
| Random CN | High-entropy Common Name | High |
| IP address as CN | CN is an IP, not a domain | Medium |
| Default values | CN like "localhost", "test", "example" | Medium |
| Known bad issuer | Issuer matches known malicious CA | High |
| Mismatched names | CN/SAN does not match requested domain | Medium |
| Future notBefore | Certificate not yet valid | Medium |
| Weak key size | RSA <2048 bits | Low-Medium |

### Malware Certificate Patterns

**Cobalt Strike default:**
- Self-signed
- Random serial number
- Default CN values or short random strings
- Validity typically 1 year

**Metasploit:**
- Self-signed with random values
- Often uses "localhost" or random strings
- Default validity periods

**Let's Encrypt abuse:**
- Valid, trusted certificate
- But issued to DGA or suspicious domains
- Very recent issuance date
- Short 90-day validity (standard for Let's Encrypt)

---

## JARM Fingerprinting

JARM is an active TLS server fingerprinting tool that sends specific TLS ClientHello
messages and hashes the server responses.

```bash
# Install JARM
pip install jarm

# Scan a server
python -c "from jarm import JARM; print(JARM.scan('target.com', 443))"
```

### Known JARM Hashes

| JARM Hash | Associated Server |
|-----------|-------------------|
| `07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1` | Cobalt Strike 4.x |
| `21d14d00021d21d21c21d14d21d21d4d41414141414141414141414141414141` | Default Metasploit |

---

## ESNI/ECH Detection

Encrypted SNI (ESNI) and Encrypted Client Hello (ECH) hide the requested hostname.
While legitimate for privacy, malware can abuse this to hide C2 destinations.

```bash
# Detect ESNI/ECH usage
tshark -r capture.pcap -Y "tls.handshake.extensions.type == 65486"

# Look for connections without visible SNI
tshark -r capture.pcap -Y "tls.handshake.type==1 && !tls.handshake.extensions_server_name"
```

---

## Certificate Chain Validation

### Checking the Chain

```bash
# Extract certificate chain from PCAP
# Use Wireshark: export the certificate bytes from packet details

# Verify with OpenSSL
openssl verify -CAfile ca-bundle.crt server-cert.pem

# Display certificate details
openssl x509 -in cert.pem -text -noout

# Check certificate dates
openssl x509 -in cert.pem -dates -noout
```

### Red Flags in Certificate Chains

1. **Self-signed root with no intermediates**: Likely malware-generated
2. **Certificate chain depth of 1**: No intermediate CAs
3. **Untrusted root CA**: Root not in system trust store
4. **Revoked certificates**: Certificate revocation detected
5. **Weak signature algorithm**: MD5 or SHA-1 signatures

---

## Practical Analysis Workflow

### Step 1: Identify All TLS Sessions

```bash
tshark -r capture.pcap -Y "tls" -T fields \
    -e ip.src -e ip.dst -e tcp.dstport | sort -u
```

### Step 2: Extract JA3 Fingerprints

```bash
tshark -r capture.pcap -Y "tls.handshake.type==1" -T fields \
    -e ip.src -e tls.handshake.extensions_server_name \
    -e tls.handshake.ja3 | sort -u
```

### Step 3: Check for Self-Signed Certificates

Look at certificate messages where issuer matches subject.

### Step 4: Correlate with Other Indicators

- Match TLS destinations with DNS queries
- Compare JA3 hashes against known malware databases
- Check certificate issuers against known malicious CAs
- Correlate timing with other suspicious network activity

### Step 5: Report Findings

Document:
- JA3/JA3S fingerprints with associated IPs/domains
- Certificate details (CN, issuer, validity, serial)
- Any matched known malicious fingerprints
- Anomalous TLS behavior (weak ciphers, self-signed, etc.)