Vulnerabilities / Threats

6/20/2018
07:00 AM
50%
50%

Mylobot Malware Brings New Sophistication to Botnets

The malware pulls together a variety of techniques to gain a foothold and remain undiscovered.

Cybercriminals looking to maximize their investments are using evermore sophisticated software techniques and increasingly aggressive steps against their fellow malware authors. Those are among the conclusions by researchers at Deep Instinct about a new strain of malware found within the last two months.

The new malware, dubbed Mylobot, pulls together a variety of techniques to gain a foothold and remain undiscovered. Among the strategies employed are:

  • Anti-VM techniques
  • Anti-sandbox techniques
  • Anti-debugging techniques
  • Wrapping internal parts with an encrypted resource file
  • Code injection
  • Process hollowing (a technique where an attacker creates a new process in a suspended state and replaces its image with the one that is to be hidden)
  • Reflective EXE (executing EXE files directly from memory, without having them on disk) 
  • A 14-day delay before accessing its C&C servers. 

"On a daily basis we come across dozens of highly sophisticated samples, but this one is a unique collection of highly advanced techniques," says Arik Solomon, vice president of R&D at Deep Instinct. "Each of the techniques is known and used by a few malicious samples, but the combination is unique."

Solomon noted that Mylobot — named for a researcher's dog — is a downloader: It can be purposed to download and install any type of payload, from spambot or DDoS engine to keylogger or banking Trojan. "I think that what we see here is the productization or even industrialization of malware techniques," says Tom Nipravsky, security researcher at Deep Instinct.

That industrialization aspect fits with what Solomon sees as the driving force behind this new malware. "It always comes down to money," he says. And that's especially true given one of Mylobot's behaviors: It seeks out and shuts down competing botnet software.

"We see the capability to make sure you have no competition," Solomon says, noting that in the highly unregulated world of malware, having more infected systems at your disposal than the competition can offer might be a matter of millions of dollars.

Mylobot leverages several techniques to make sure no other botnet is active on a machine it infects. "Usually we see this behavior when malware tries to shut down defensive software," Solomon notes. "In this case, it's fighting against its competition."

Though the researchers have been looking at Mylobot for several weeks, they aren't yet ready to say who the author is. There are some clues, though, including the fact that Mylobot scans for keyboard layout of an infected machine and doesn't execute if it finds an Asian character set and layout in use. Nipravsky says this could have to do with encryption algorithms, but it might well speak to the geographical nexus of the malware.

The researchers say it's important to note that Mylobot was found in the wild, at a Tier 1 data communication and telecommunication equipment manufacturer, not in a proof-of-concept demonstration.

"It's a relatively good representative of what we see on the Dark Web where people are selling platforms for others to use," Solomon says. Customers of the botnet can rent time to download and run their own payloads, making this a very efficient use of malware technology.

One thing the researchers are confident about is the sophistication of the malware's authors. "This presents itself as a product that we all could be envious of," Nipravsky says. "The integration, how it operates, how it was developed by different teams around the world, the different layers all combine to create a single malicious product."

Related Content:

Why Cybercriminals Attack: A DARK READING VIRTUAL EVENT Wednesday, June 27. Industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Go here for more information on this free event.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: White Privelege Day
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-6504
PUBLISHED: 2018-09-20
A potential Cross-Site Request Forgery (CSRF) vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for Cross-Site Request Forgery (CSRF).
CVE-2018-6505
PUBLISHED: 2018-09-20
A potential Unauthenticated File Download vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for Unauthenticated File Downloads.
CVE-2018-14796
PUBLISHED: 2018-09-20
Tec4Data SmartCooler, all versions prior to firmware 180806, the device responds to a remote unauthenticated reboot command that may be used to perform a denial of service attack.
CVE-2018-14821
PUBLISHED: 2018-09-20
Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote, unauthenticated threat actor to intentionally send a malformed CIP packet to Port 44818, causing the RSLinx Classic application to terminate. The user will need to manually restart the software to r...
CVE-2018-14827
PUBLISHED: 2018-09-20
Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. A remote, unauthenticated threat actor may intentionally send specially crafted Ethernet/IP packets to Port 44818, causing the software application to stop responding and crash. The user must restart the software to regain functionality.