05:06 PM
Connect Directly

Financial Malware Detects Remote Desktop Environments To Evade Researchers

'Shylock' malware joins the list of malicious programs enhancing their defenses to avoid analysis by researchers

Like any other group of business people, cybercriminals want to protect their investments.

In the case of malware, that means thwarting research and analysis. According to Trusteer, the author of the financial malware platform known as Shylock has added a new mechanism to identify and avoid remote desktop environments commonly used by researchers when analyzing malware.

"Suspected malware samples are collected for analysis and often placed onto machines that are isolated in an operations center ("lab")," explains Gal Frishman, malware research team leader at Trusteer, in a blog post. "Rather than sitting in front of a rack of physical machines in a cold basement lab, researchers use remote desktop connections to study malware from the convenience and coziness of their offices.

"It is this human weakness that Shylock exploits," Frishman continues. "We have discovered advanced malware that is now capable of detecting remote desktop environments to evade researchers."

The Shylock dropper does this by feeding invalid data into a particular routine and then watching the error code that gets returned. It uses this return code to differentiate between normal desktops and lab environments, the researcher explains. When executed from a remote desktop session, the return code will be different and the malware will not install.

"The dropper dynamically loads Winscard.dll and calls the functionSCardForgetReaderGroupA(0, 0)," writes Fishman. "The malware proceeds as expected only if the return value is either 0x80100011 (SCARD_E_INVALID_VALUE) or 0x2 (ERROR_FILE_NOT_FOUND). We noticed that when the dropper is executed locally the return value is 0x80100011, but when it is executed from a remote desktop session the return value is 0x80100004 (SCARD_E_INVALID_PARAMETER)."

Malware authors are continuously developing techniques to evade sandboxes used for analysis, notes Vikram Thakur, principal manger at Symantec Security Response.

"There are many virtual environments that are detected by malware these days," he tells Dark Reading. "In fact, just recently we spotted two new techniques added to the list of techniques used by malware to evade sandboxes -- monitoring of mouse movement and monitoring for code to lay dormant for five minutes before execution.

"Avoiding remote desktop sessions can, indeed, work to accomplish the same purpose," he adds. "At the end of the day, malware authors realize that organizations use automated techniques in order to determine the capabilities of malware. By investing development time to circumvent sandboxes, they are trying to buy themselves some time before they get detected."

At the Black Hat security conference (PDF) this year, researchers presented techniques they said could make malware analysis unscalable by designing malware that fails to execute correctly on any environment other than the one originally affected.

In the coming year, those types of techniques will become more common, predicts Tomer Teller, security evangelist with Check Point Software Technologies.

"Malware will be more dedicated and will attack only computers with a specific configuration," he says. "The ability of malware to thwart analysis will improve in the new year."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-07-09
Heap-based buffer overflow in the xjpegls.dll (aka JLS, JPEG-LS, or JPEG lossless) format plugin in XnView 1.99 and 1.99.1 allows remote attackers to execute arbitrary code via a crafted JLS image file.

Published: 2014-07-09
The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.

Published: 2014-07-09
Adobe Flash Player before and 14.x before on Windows and OS X and before on Linux, Adobe AIR before on Android, Adobe AIR SDK before, and Adobe AIR SDK & Compiler before allow attackers to bypass intended access restrictions via uns...

Published: 2014-07-09
Adobe Flash Player before and 14.x before on Windows and OS X and before on Linux, Adobe AIR before on Android, Adobe AIR SDK before, and Adobe AIR SDK & Compiler before allow attackers to bypass intended access restrictions via uns...

Published: 2014-07-09
The NTP implementation in Cisco IOS and IOS XE does not properly support use of the access-group command for a "deny all" configuration, which allows remote attackers to bypass intended restrictions on time synchronization via a standard query, aka Bug ID CSCuj66318.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.