New 'imitation game' feature helps botnet-for-rent fool security tools that use sandboxing.

Sara Peters, Senior Editor

August 10, 2015

2 Min Read

DGA.Changer has added a new trick to its arsenal:  a technique to fool security tools into thinking they've captured it while it's already slipped away, according to new research from Seculert.

DGA.Changer is a botnet-for-rent used for click fraud campaigns, information-stealing, and delivering remote access Trojans, and is sold for targeted purposes as well.

It uses an infinite domain generation algorithm (DGA), plus the command-and-control server can send issue commands to the bots to change the DGA seed (hence the name). This always made it difficult to detect, because as Seculert described when first detailing the malware in 2013, "the initial sample will reveal the domain name streams before the change — which no longer resolve to the C2 server."

Recently, the malware writers have taken those anti-detection capabilities even further.

“A new feature they added several months ago is if they detect they are in a virtualized environment like a sandbox, they generate a fake stream,” says Aviv Raff, CTO of Seculert.

DGA Changer will look for evidence of VMWare, Virtual Box and other virtualization products to check whether or not the malware is runing within a virtual machine. If so, it alters the DGA seed, communicates with the fake domains, and downloads an executable file -- but that executable does nothing more than exit after being executed.

In other words, all that’s in the sandbox is a decoy, Raff says.

As Raff wrote, "the goal here seems to be to fool sandbox solutions and/or researchers into believing the malware is fully functional and downloading additional components. ... The discovery of this new version of DGA.Changer highlights yet again the limitations of 'sandbox only' prevention approaches and the need to complement them with post-infection analytics based detection techniques." 

Kelly Jackson Higgins contributed to this story.

About the Author(s)

Sara Peters

Senior Editor

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad of other topics. She authored the 2009 CSI Computer Crime and Security Survey and founded the CSI Working Group on Web Security Research Law -- a collaborative project that investigated the dichotomy between laws regulating software vulnerability disclosure and those regulating Web vulnerability disclosure.


Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights