Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/10/2015
03:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

DGA.Changer Gets Anti-Detection Upgrade

New 'imitation game' feature helps botnet-for-rent fool security tools that use sandboxing.

DGA.Changer has added a new trick to its arsenal:  a technique to fool security tools into thinking they've captured it while it's already slipped away, according to new research from Seculert.

DGA.Changer is a botnet-for-rent used for click fraud campaigns, information-stealing, and delivering remote access Trojans, and is sold for targeted purposes as well.

It uses an infinite domain generation algorithm (DGA), plus the command-and-control server can send issue commands to the bots to change the DGA seed (hence the name). This always made it difficult to detect, because as Seculert described when first detailing the malware in 2013, "the initial sample will reveal the domain name streams before the change — which no longer resolve to the C2 server."

Recently, the malware writers have taken those anti-detection capabilities even further.

“A new feature they added several months ago is if they detect they are in a virtualized environment like a sandbox, they generate a fake stream,” says Aviv Raff, CTO of Seculert.

DGA Changer will look for evidence of VMWare, Virtual Box and other virtualization products to check whether or not the malware is runing within a virtual machine. If so, it alters the DGA seed, communicates with the fake domains, and downloads an executable file -- but that executable does nothing more than exit after being executed.

In other words, all that’s in the sandbox is a decoy, Raff says.

As Raff wrote, "the goal here seems to be to fool sandbox solutions and/or researchers into believing the malware is fully functional and downloading additional components. ... The discovery of this new version of DGA.Changer highlights yet again the limitations of 'sandbox only' prevention approaches and the need to complement them with post-infection analytics based detection techniques." 

Kelly Jackson Higgins contributed to this story.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Perry Cybereason
100%
0%
Perry Cybereason,
User Rank: Apprentice
8/11/2015 | 2:52:06 PM
The eternal flaw of one-shot detection methods

When you examine the attack in vitro, it is too easy for the attacker to fool you. The burden of making it work is on you and the attacker only has to choose which escape trick to use. This is especially highlighted when you use a one-shot decision model. If the malware fools you in that specific moment, it is safe to do as it will thereafter.

When you keep your eye open in the full, real environment, at all times, there is no fooling you. Detection is running in situ on the actual behavior patterns of the attacker and these are bound to reveal its true nature.

Cybereason detects the old and new variants of this malware, not by knowing them in particular, but by detecting its true nature in situ. Check out our DGA related blog posts for more details.

RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/11/2015 | 9:03:35 AM
Sandbox Conditional Coding
I'm curious as to what the criteria is for the DGA Changer to set up the fake stream as obviously not all virtual environments are sandboxes. Maybe they don't even risk it and just consider all virtual environments an area to which they do not want to be involved.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11583
PUBLISHED: 2020-08-03
A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
CVE-2020-11584
PUBLISHED: 2020-08-03
A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
CVE-2020-5770
PUBLISHED: 2020-08-03
Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.01 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
CVE-2020-5771
PUBLISHED: 2020-08-03
Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious backup archive.
CVE-2020-5772
PUBLISHED: 2020-08-03
Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious package file.