Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Mylobot Malware Brings New Sophistication to Botnets

The malware pulls together a variety of techniques to gain a foothold and remain undiscovered.

Cybercriminals looking to maximize their investments are using evermore sophisticated software techniques and increasingly aggressive steps against their fellow malware authors. Those are among the conclusions by researchers at Deep Instinct about a new strain of malware found within the last two months.

The new malware, dubbed Mylobot, pulls together a variety of techniques to gain a foothold and remain undiscovered. Among the strategies employed are:

  • Anti-VM techniques
  • Anti-sandbox techniques
  • Anti-debugging techniques
  • Wrapping internal parts with an encrypted resource file
  • Code injection
  • Process hollowing (a technique where an attacker creates a new process in a suspended state and replaces its image with the one that is to be hidden)
  • Reflective EXE (executing EXE files directly from memory, without having them on disk) 
  • A 14-day delay before accessing its C&C servers. 

"On a daily basis we come across dozens of highly sophisticated samples, but this one is a unique collection of highly advanced techniques," says Arik Solomon, vice president of R&D at Deep Instinct. "Each of the techniques is known and used by a few malicious samples, but the combination is unique."

Solomon noted that Mylobot — named for a researcher's dog — is a downloader: It can be purposed to download and install any type of payload, from spambot or DDoS engine to keylogger or banking Trojan. "I think that what we see here is the productization or even industrialization of malware techniques," says Tom Nipravsky, security researcher at Deep Instinct.

That industrialization aspect fits with what Solomon sees as the driving force behind this new malware. "It always comes down to money," he says. And that's especially true given one of Mylobot's behaviors: It seeks out and shuts down competing botnet software.

"We see the capability to make sure you have no competition," Solomon says, noting that in the highly unregulated world of malware, having more infected systems at your disposal than the competition can offer might be a matter of millions of dollars.

Mylobot leverages several techniques to make sure no other botnet is active on a machine it infects. "Usually we see this behavior when malware tries to shut down defensive software," Solomon notes. "In this case, it's fighting against its competition."

Though the researchers have been looking at Mylobot for several weeks, they aren't yet ready to say who the author is. There are some clues, though, including the fact that Mylobot scans for keyboard layout of an infected machine and doesn't execute if it finds an Asian character set and layout in use. Nipravsky says this could have to do with encryption algorithms, but it might well speak to the geographical nexus of the malware.

The researchers say it's important to note that Mylobot was found in the wild, at a Tier 1 data communication and telecommunication equipment manufacturer, not in a proof-of-concept demonstration.

"It's a relatively good representative of what we see on the Dark Web where people are selling platforms for others to use," Solomon says. Customers of the botnet can rent time to download and run their own payloads, making this a very efficient use of malware technology.

One thing the researchers are confident about is the sophistication of the malware's authors. "This presents itself as a product that we all could be envious of," Nipravsky says. "The integration, how it operates, how it was developed by different teams around the world, the different layers all combine to create a single malicious product."

Related Content:

Why Cybercriminals Attack: A DARK READING VIRTUAL EVENT Wednesday, June 27. Industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Go here for more information on this free event.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.