The malware pulls together a variety of techniques to gain a foothold and remain undiscovered.

Cybercriminals looking to maximize their investments are using evermore sophisticated software techniques and increasingly aggressive steps against their fellow malware authors. Those are among the conclusions by researchers at Deep Instinct about a new strain of malware found within the last two months.

The new malware, dubbed Mylobot, pulls together a variety of techniques to gain a foothold and remain undiscovered. Among the strategies employed are:

  • Anti-VM techniques

  • Anti-sandbox techniques

  • Anti-debugging techniques

  • Wrapping internal parts with an encrypted resource file

  • Code injection

  • Process hollowing (a technique where an attacker creates a new process in a suspended state and replaces its image with the one that is to be hidden)

  • Reflective EXE (executing EXE files directly from memory, without having them on disk) 

  • A 14-day delay before accessing its C&C servers. 

"On a daily basis we come across dozens of highly sophisticated samples, but this one is a unique collection of highly advanced techniques," says Arik Solomon, vice president of R&D at Deep Instinct. "Each of the techniques is known and used by a few malicious samples, but the combination is unique."

Solomon noted that Mylobot — named for a researcher's dog — is a downloader: It can be purposed to download and install any type of payload, from spambot or DDoS engine to keylogger or banking Trojan. "I think that what we see here is the productization or even industrialization of malware techniques," says Tom Nipravsky, security researcher at Deep Instinct.

That industrialization aspect fits with what Solomon sees as the driving force behind this new malware. "It always comes down to money," he says. And that's especially true given one of Mylobot's behaviors: It seeks out and shuts down competing botnet software.

"We see the capability to make sure you have no competition," Solomon says, noting that in the highly unregulated world of malware, having more infected systems at your disposal than the competition can offer might be a matter of millions of dollars.

Mylobot leverages several techniques to make sure no other botnet is active on a machine it infects. "Usually we see this behavior when malware tries to shut down defensive software," Solomon notes. "In this case, it's fighting against its competition."

Though the researchers have been looking at Mylobot for several weeks, they aren't yet ready to say who the author is. There are some clues, though, including the fact that Mylobot scans for keyboard layout of an infected machine and doesn't execute if it finds an Asian character set and layout in use. Nipravsky says this could have to do with encryption algorithms, but it might well speak to the geographical nexus of the malware.

The researchers say it's important to note that Mylobot was found in the wild, at a Tier 1 data communication and telecommunication equipment manufacturer, not in a proof-of-concept demonstration.

"It's a relatively good representative of what we see on the Dark Web where people are selling platforms for others to use," Solomon says. Customers of the botnet can rent time to download and run their own payloads, making this a very efficient use of malware technology.

One thing the researchers are confident about is the sophistication of the malware's authors. "This presents itself as a product that we all could be envious of," Nipravsky says. "The integration, how it operates, how it was developed by different teams around the world, the different layers all combine to create a single malicious product."

Related Content:

Why Cybercriminals Attack: A DARK READING VIRTUAL EVENT Wednesday, June 27. Industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Go here for more information on this free event.

About the Author(s)

Curtis Franklin, Principal Analyst, Omdia

Curtis Franklin Jr. is Principal Analyst at Omdia, focusing on enterprise security management. Previously, he was senior editor of Dark Reading, editor of Light Reading's Security Now, and executive editor, technology, at InformationWeek, where he was also executive producer of InformationWeek's online radio and podcast episodes

Curtis has been writing about technologies and products in computing and networking since the early 1980s. He has been on staff and contributed to technology-industry publications including BYTE, ComputerWorld, CEO, Enterprise Efficiency, ChannelWeb, Network Computing, InfoWorld, PCWorld, Dark Reading, and ITWorld.com on subjects ranging from mobile enterprise computing to enterprise security and wireless networking.

Curtis is the author of thousands of articles, the co-author of five books, and has been a frequent speaker at computer and networking industry conferences across North America and Europe. His most recent books, Cloud Computing: Technologies and Strategies of the Ubiquitous Data Center, and Securing the Cloud: Security Strategies for the Ubiquitous Data Center, with co-author Brian Chee, are published by Taylor and Francis.

When he's not writing, Curtis is a painter, photographer, cook, and multi-instrumentalist musician. He is active in running, amateur radio (KG4GWA), the MakerFX maker space in Orlando, FL, and is a certified Florida Master Naturalist.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights