DGA.Changer Gets Anti-Detection UpgradeDGA.Changer Gets Anti-Detection Upgrade
New 'imitation game' feature helps botnet-for-rent fool security tools that use sandboxing.
August 10, 2015
DGA.Changer has added a new trick to its arsenal: a technique to fool security tools into thinking they've captured it while it's already slipped away, according to new research from Seculert.
DGA.Changer is a botnet-for-rent used for click fraud campaigns, information-stealing, and delivering remote access Trojans, and is sold for targeted purposes as well.
It uses an infinite domain generation algorithm (DGA), plus the command-and-control server can send issue commands to the bots to change the DGA seed (hence the name). This always made it difficult to detect, because as Seculert described when first detailing the malware in 2013, "the initial sample will reveal the domain name streams before the change — which no longer resolve to the C2 server."
Recently, the malware writers have taken those anti-detection capabilities even further.
“A new feature they added several months ago is if they detect they are in a virtualized environment like a sandbox, they generate a fake stream,” says Aviv Raff, CTO of Seculert.
DGA Changer will look for evidence of VMWare, Virtual Box and other virtualization products to check whether or not the malware is runing within a virtual machine. If so, it alters the DGA seed, communicates with the fake domains, and downloads an executable file -- but that executable does nothing more than exit after being executed.
In other words, all that’s in the sandbox is a decoy, Raff says.
As Raff wrote, "the goal here seems to be to fool sandbox solutions and/or researchers into believing the malware is fully functional and downloading additional components. ... The discovery of this new version of DGA.Changer highlights yet again the limitations of 'sandbox only' prevention approaches and the need to complement them with post-infection analytics based detection techniques."
Kelly Jackson Higgins contributed to this story.
About the Author(s)
You May Also Like
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
What's In Your Cloud?Nov 30, 2023
Everything You Need to Know About DNS AttacksNov 30, 2023
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
Get the Gartner Report: SOC Model Guide
Gone Phishing: How to Defend Against Persistent Phishing Attempts Targeting Your Organization
Building Immunity: The 2021 Healthcare and Pharmaceutical Industry Cyber Threat Landscape Report