05:06 PM
Connect Directly
Repost This

Financial Malware Detects Remote Desktop Environments To Evade Researchers

'Shylock' malware joins the list of malicious programs enhancing their defenses to avoid analysis by researchers

Like any other group of business people, cybercriminals want to protect their investments.

In the case of malware, that means thwarting research and analysis. According to Trusteer, the author of the financial malware platform known as Shylock has added a new mechanism to identify and avoid remote desktop environments commonly used by researchers when analyzing malware.

"Suspected malware samples are collected for analysis and often placed onto machines that are isolated in an operations center ("lab")," explains Gal Frishman, malware research team leader at Trusteer, in a blog post. "Rather than sitting in front of a rack of physical machines in a cold basement lab, researchers use remote desktop connections to study malware from the convenience and coziness of their offices.

"It is this human weakness that Shylock exploits," Frishman continues. "We have discovered advanced malware that is now capable of detecting remote desktop environments to evade researchers."

The Shylock dropper does this by feeding invalid data into a particular routine and then watching the error code that gets returned. It uses this return code to differentiate between normal desktops and lab environments, the researcher explains. When executed from a remote desktop session, the return code will be different and the malware will not install.

"The dropper dynamically loads Winscard.dll and calls the functionSCardForgetReaderGroupA(0, 0)," writes Fishman. "The malware proceeds as expected only if the return value is either 0x80100011 (SCARD_E_INVALID_VALUE) or 0x2 (ERROR_FILE_NOT_FOUND). We noticed that when the dropper is executed locally the return value is 0x80100011, but when it is executed from a remote desktop session the return value is 0x80100004 (SCARD_E_INVALID_PARAMETER)."

Malware authors are continuously developing techniques to evade sandboxes used for analysis, notes Vikram Thakur, principal manger at Symantec Security Response.

"There are many virtual environments that are detected by malware these days," he tells Dark Reading. "In fact, just recently we spotted two new techniques added to the list of techniques used by malware to evade sandboxes -- monitoring of mouse movement and monitoring for code to lay dormant for five minutes before execution.

"Avoiding remote desktop sessions can, indeed, work to accomplish the same purpose," he adds. "At the end of the day, malware authors realize that organizations use automated techniques in order to determine the capabilities of malware. By investing development time to circumvent sandboxes, they are trying to buy themselves some time before they get detected."

At the Black Hat security conference (PDF) this year, researchers presented techniques they said could make malware analysis unscalable by designing malware that fails to execute correctly on any environment other than the one originally affected.

In the coming year, those types of techniques will become more common, predicts Tomer Teller, security evangelist with Check Point Software Technologies.

"Malware will be more dedicated and will attack only computers with a specific configuration," he says. "The ability of malware to thwart analysis will improve in the new year."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-04-23
Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCtn22376.

Published: 2014-04-23
The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route Processor crash) by sending packets at a high rate, aka Bug ID CSCts37717.

Published: 2014-04-23
Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544.

Published: 2014-04-23
Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of service (CPU consumption or device crash) via MLD packets on a network that contains many IPv6 hosts, aka Bug ID CSCtr88193.

Published: 2014-04-23
Cisco IOS before 15.3(1)T on Cisco 2900 devices, when a VWIC2-2MFT-T1/E1 card is configured for TDM/HDLC mode, allows remote attackers to cause a denial of service (serial-interface outage) via certain Frame Relay traffic, aka Bug ID CSCub13317.

Best of the Web