Malware Dyre detect the sandbox. Windows users in danger?

  • Thread starter Thread starter LabZero
  • Start date Start date
Status
Not open for further replies.
L

LabZero

Thread author
The Trojan Banking Dyre, who has already stolen more than one million access to data banks worldwide, was spotted in a new form that makes it undetectable by anti-sandboxing techniques.

The trojan checks how many processor cores are active and, if it has one, the trojan will stop. Because the Virtual machines are often configured with a single core processor, this is a very effective avoidance technique.

The trojan downloader Upatre-based, acting through the infected dll injection, and unsafe executable by editing the registry keys of the operating system. At present are at risk all Windows systems.
 
Last edited by a moderator:
Not exactly in danger because it only terminates if there is a sandbox, it doesn't escape the sandbox itself so it would pose no danger even if you run it in a sandbox.
 
  • Like
Reactions: frogboy and LabZero
I agree, the subject of the article is misleading, one might think that Dyre has found a way to execute its code outside of the Sandbox environment, which isn’t the case here.
 
  • Like
Reactions: frogboy
These malware "alert" articles are really getting very annoying. Initially developed by a certain Russian AV hawker they have been a popular way to spread fear (the company of course would say Spread Awareness) and to push their products. This one follows the same format as K's articles and Cisco's recent blogs- find some malware or other (hopefully new), make it seem like THE WORST THING EVER, add a few lines of code to impress the ignorant, then push their product.

The original articles was here: http://www.seculert.com/blog/2015/04/new-dyre-version-evades-sandboxes.html

The last sentence will lead you to a way to protect from this horror:

This approach will provide a much more comprehensive security posture in today’s worsening threat landscape.

Of course what they don't state is that the Dyre malware has been around for about a year and that VM awareness has been added a few months ago. They also want you to assume that a sample that doesn't run in a VM will be immediately flagged as good and thus will be a threat. What they don't say is that:

1). Many Enterprise Sandboxed based products have a cloud component- when an unknown is detected real-time forensics will kick in (the sample is run in a non-VM environment to note effects) and then a decision is made to whether the sample is malicious or not.
2). For the Home user if this sample is run in a non-virtualized environment even if the data collector is not detected as malicious- which it will probably be: https://www.virustotal.com/en/file/...173dfaa9d95afad6396bb741/analysis/1431253282/

the user would still get an Outbound Firewall alert, thus stopping the transmitter.

Final sad points about this article are the Download Sample link will lead to:

https://malwr.com/analysis/Y2ZiMjQyMzA2MWZkNDk2ZGEzNmNlYWYzOGE5YmUwMGU/

and there please note that the sample isn't shared- as if everyone and their cat doesn't already have this one (I uploaded a sample into Virus Exchange- it will show up there when approved).

Second sad point is that the lay press just loves to pick up on these Trash Publicity alerts and spread them around the net.

Sorry for the rant, but I'm still feeling the wine from last night.
 
Last edited:
@cruelsister you are right, the article is misleading and the infection possibility by a malware that has been engineered specifically by a researcher does not raise the danger level any higher then normally.
Yet the bigger point here is not this particular malware in question, the point is that it is possible to engineer a malware that can go viral and that has advanced options to beat common security configurations.
Keep in mind that some of these professional malware writers truly know how and what to do in order to come up with the next big thing malware wise.
Nowadays the implications of a advanced malware variant can be huge, maybe not so much in damage like the old days, but money wise some of the lesser malware out there is worth every penny.
I do not recall what the name of the Trojan was a few years ago that haunted popular premium porn sites, but the malware did take a few cents from every transaction made between the client and the porn website (premium calls over internet and cam porn) this way the Trojan did gather huge amounts of very small transactions without being noticed for years.
Result was that a 500 dollar Trojan generated thousands of euro's (If not millions)
Now that's what i call some bang for your buck.

Now while i agree with you that some of these malware findings are getting annoying and are virtually always blown out of proportions then thing is that if a researcher can write or alter a malware code in such way that it detects VM environments (Assuming it does a good job) then yes professionally speaking this has HUGE implications, because from my POV VM detection equals VM termination and possible infection.
On of the biggest pro's to a VM environment is that malware usually cannot successfully detect it and map the structure.
Because there are actually some malware types out there that can easily turn a VM system hostile or corrupt but failed in doing so due to lack of detection and mapping.
Now with a article like this showing it can be done, it is only a small step away before Hacker X has a brain wave and creates a shitstorm.
Today's computers are much much faster then Windows needs and can handle so writing complex malware has become much easier as in the old days you could just listen to your PC and you would know that it was doing something, not to mention the noticeable slowdown.
Today computers have so much computing power and the data speeds are higher then the average scanning interrupts used by AV engines, giving malware a bigger window of opportunity to do its stuff.

That being said there is one other point i would like to address and that is notion that people claim: I use VM so who cares what malware comes along? I do not need anything as VM will not allow it to spread or damage my system.
Specially programs like sandboxie have been hyped and sandbox capable firewalls and AV programs, and this is what i have been saying since i came here on the site, i remember myself getting flamed right left and center by sandboxie and comodo fanboys.
Yet articles like this (Specificly about VM/Sandbox type of malware and security risks proof my point time after time again)
And while this article is news, within the industry we have known about some malware that actually eat VM for dinner and punches right trough its barriers. (Granted those infections are either a inside job, or heavy sponsored by some party that has a need to penetrate a corporate system) so thats why most home users and people not directly involved in the industry did not know about it.
Because you are talking about malware that is only being found ones or twice, its infection rate is NIHIL if not ZERO.

But yeah i totally agree this article while useful is getting on my nerves like most of these malwares articles as they are ALL made to look like a new 100% mortality rate EBOLA variant.
Some news sites post these articles in such way that one would start thinking that it not only infects computers.... Hence why chinese hackers all ware a face mask WHAHAHAHAHAHAA
 
As Mikko Hypponen said malware writers are making millions, they can now have the ability to hire testing people, testing their malware against security software, so they can get around them. I know longer do internet banking, do not trust it.
 
Hi Nico! You make great points as always.

What has been really irritating me is that these malware alerts recently have been nothing more than thinly-veiled advertisements for frequently substandard products. In this particular case the VM-awareness of the malware is emphasized, as if that is something new. General Environment checks by malware have exists for eons (well, maybe not quite that long), and specific checks for especially VMWare (System Services lists, unique dll checks, VMX Com Port check) are also known. So nothing new here.

For the home user, taking something out of the sandbox is equally as suicidal as ignoring a definition based detection, and in the Enterprise space a forensic backed sandbox routine should also preclude harm (although I just LOVE the corporate VM networked system that some IT clowns institute- the Universe breeds both insects and fools in numbers beyond imagining).

And you are very right that malware VM jumping usually is only seen (except for exploiting an emulator flaw, but that's why God created patches) on a targeted basis, and the company involved normally pays very, very well to suppress this little tidbit from going public.

But to the important point- Did you stop smoking????????
 
  • Like
Reactions: Moose
Hi Nico! You make great points as always.

What has been really irritating me is that these malware alerts recently have been nothing more than thinly-veiled advertisements for frequently substandard products. In this particular case the VM-awareness of the malware is emphasized, as if that is something new. General Environment checks by malware have exists for eons (well, maybe not quite that long), and specific checks for especially VMWare (System Services lists, unique dll checks, VMX Com Port check) are also known. So nothing new here.

For the home user, taking something out of the sandbox is equally as suicidal as ignoring a definition based detection, and in the Enterprise space a forensic backed sandbox routine should also preclude harm (although I just LOVE the corporate VM networked system that some IT clowns institute- the Universe breeds both insects and fools in numbers beyond imagining).

And you are very right that malware VM jumping usually is only seen (except for exploiting an emulator flaw, but that's why God created patches) on a targeted basis, and the company involved normally pays very, very well to suppress this little tidbit from going public.

But to the important point- Did you stop smoking????????

Me stopped smoking? Uhhhm is this a trick question? I am Dutch remember LMAO.
clownstone_jjth29qs.jpg


Cheers
 
The Trojan Banking Dyre, who has already stolen more than one million access to data banks worldwide, was spotted in a new form that makes it undetectable by anti-sandboxing techniques.

The trojan checks how many processor cores are active and, if it has one, the trojan will stop. Because the Virtual machines are often configured with a single core processor, this is a very effective avoidance technique.

The trojan downloader Upatre-based, acting through the infected dll injection, and unsafe executable by editing the registry keys of the operating system. At present are at risk all Windows systems.
In this case can Comodo be the best option?
 
Status
Not open for further replies.