New powerful malware obfuscation technique
ieeexplore.ieee.org
New powerful malware obfuscation technique
1–10 of 18 posts
Re: New powerful malware obfuscation technique
#2The abstract is highly readable. I don't have time to read it now, but the strategy sounds amazing!
The strategy is that malware should imitate user behavior to throw AVs of their scent. The context in which it does this is with system calls as those happened to be monitored a lot by malware detection software.
Re: New powerful malware obfuscation technique
#3This probably should contain a [pdf] tag.
Re: New powerful malware obfuscation technique
#4So the big idea is "simulate user keypresses and mouse events", and it works if the user answers "yes" to the prompt "Program X wants to control other programs on this computer".
To be fair, Steam games request that permission, so users may be trained to accept it.
Re: New powerful malware obfuscation technique
#5There is a paper summary on YouTube: https://www.youtube.com/watch?v=uf08omKOoxY
25 pages of academic english are hard to read :)
Re: New powerful malware obfuscation technique
#6It shows a new dimension of attack vectors: Instead of exploiting vulnerabilities of a program (e.g. Buffer Overflow), the design of a user interface is exploited for reaching an arbitrary code execution as trusted system user.
Re: New powerful malware obfuscation technique
#7Pretending to be a user is a good way around some anti cheat systems as well.
The computer game FIFA has an online marketplace where you can buy and sell players, and a lot of people write Chrome extensions (or Puppeteer bots) to "script" hotkeys or create sniping bots, but since EA track you constantly, they can figure it out eventually. Instead, I wrote some code to control the mouse and keyboard with cliclick (https://github.com/BlueM/cliclick), move the pointer around naturally, etc. and you can leave it running for hours without incident. https://pyautogui.readthedocs.io/en/latest/ is another approach to doing this for any Pythonistas in the house.
Re: New powerful malware obfuscation technique
#8The paper doesn’t mention how an elevated token was acquired. You cannot run bcdedit without privileges. Not all users will have privileges to do this.
Re: New powerful malware obfuscation technique
#9Unfortunately, this method can avoid AMSI by using CMD commands. The infection part related to communication with the C&C server could be detected by AMSI if the attacker would use PowerShell or Windows Script Host, but the author uses Python.
All of this is interesting and can be dangerous by using offline ransomware (no C&C server). But in practice when the attacker wants to use C&C server then another scripting engine has to be used. If the attacker can install Python on the target machine then the Python scripts will be probably as dangerous as Phantom Malware.
Re: New powerful malware obfuscation technique
#10I want to sum up the most important facts:
I. An additional desktop will be created. The Windows Explorer (WE) will be opened on this desktop. Afterwards, the command will be inserted into its input box and confirmed for execution by sending corresponding Windows Messages. The victim will NOT see a CMD or any up popping window due to all these actions do not happened on the victim's current desktop.
II. Phantom Malware splits up its malicious actions into a sequence of non-malicious SendMessage WinAPI calls. (see VI. ANALYSIS → A. FAILURE OF ANTI-VIRUS SOFTWARE).
III. The WE is a preinstalled file manager and a fundamental part of the desktop environment of Windows, which makes this process trustworthy. Due to inserting and confirming a malicious command in the WE's input box, this trusted system process is manipulated to execute the command. Antivirus software will not block actions of a trusted system because it is considered bad practice. Besides, the operating system including modules of anti-virus software, such as behavior blockers, are fooled into perceiving that the user themselves has done the command insertion and its confirmation. In other words, it mistakenly looks like the execution of the malicious command has a legit basis with the user having intended the execution. (quoted form IX. CONCLUSION)