App Review Malware Obfuscation Part 1

It is advised to take all reviews with a grain of salt. In extreme cases some reviews use dramatization for entertainment purposes.
Content created by
cruelsister
Trident said:
That's gonna create a more suspicious file as opposed to firing your Visual Studio or whatever you like using, and statically linking the runtime. The method you are describing is gonna create an executable that looks awfully like a packer + dropper (low trust, very little imports, abnormal .resource section), whilst if you go for the static linking, it is still a low-trust executable, but the script will likely go in the .rdata whilst the interpreter will be precompiled in the .text section.

LUA unlike python seems to allow very easy static linking.

Depending on how the lua environment behaves the way you are describing, if it is dropped in temp or loaded via reflective injection, it will be even more suspicious and unlikely to survive encounter with typical AVs.
Click to expand...
My point is not to be argumentative - which I do not think you saw it as such. My intent was only to present one of the multitude of options threat actors have and the most determined and persistent will attempt to accomplish their objectives. For run-of-the-mill threat actors on the dark web that subscribe to services, not so much - they just do the "Spray and Pray" method.

Persistent and thorough are usually determined enough that they will keep trying until they succeed - and I do not mean just for targeted attacks. The motivation is money and there is so much money to be made that the motto "Just don't give up" is something like a lottery ticket with a big payoff.

One can convert PowerShell, Python, LUA, or any other scripting language into an executable (.exe or other equivalent execution type) file, all with various degrees of "ease of success" dependent upon how it was done - and most importantly what the malicious executable is attempting to do and how it is doing it on the system.

Nothing I have said is revolutionary nor does any of it automatically guarantee success or failure - because it is all so high level. We'd have to have a pile of samples to reverse engineer and figure out how and why some succeeded where others failed and separate those that did not work - they were executed and just sat there broken or just did nothing. None of this stuff is obvious nor does it have a "linear" learning curve.
 
  • Like
Reactions: simmerskool and Trident
Jonny Quest said:
I agree, scenarios like these are usually extreme situations, extreme malware, extreme samples, most of us will never run into or experience in our daily lives.
But, it makes for great debate :)
Click to expand...
The focus is always "How and why the malware bypassed this, that, and the other."

Virtually never is there even a glint of discussion about "What can the malware do?"

Well, nowadays there is malware out there that can literally rob you of your entire life.

Jedem Das Seine. To Each Their Own. But relying upon a low probability that it will happen to protect you is something way less than "security by obscurity" and it will not save a person, their family, and many of their assets. After the loss or losses happen, it is almost 100% that the assets (or very valuable data) shall never be recovered. For victims of identity theft, even with insurance coverage, that process takes years, time away from work, working with investigators, appearances in arbitration or court, and so on, and so on.

If it takes a person just a few minutes to erect a powerful chicken fence to keep out 99.999% of foxes and other predators, it makes no sense not to do so.

However, again, Jedem Das Seine.
 
  • Like
Reactions: Halp2001, simmerskool, Brownie2019 and 1 other person
bazang said:
The focus is always "How and why the malware bypassed this, that, and the other."

Virtually never is there even a glint of discussion about "What can the malware do?"

Well, nowadays there is malware out there that can literally rob you of your entire life.

Jedem Das Seine. To Each Their Own. But relying upon a low probability that it will happen to protect you is something way less than "security by obscurity" and it will not save a person, their family, and many of their assets. After the loss or losses happen, it is almost 100% that the assets (or very valuable data) shall never be recovered. For victims of identity theft, even with insurance coverage, that process takes years, time away from work, working with investigators, appearances in arbitration or court, and so on, and so on.

If it takes a person just a few minutes to erect a powerful chicken fence to keep out 99.999% of foxes and other predators, it makes no sense not to do so.

However, again, Jedem Das Seine.
Click to expand...
Thank you for your reply, I appreciate it. Could you also answer this question, please (a bypass question), as I did post it in sincerity. TIA :)
 
Last edited:
  • Like
Reactions: Halp2001 and simmerskool
Trident said:
The antivirus software that detects by reputation is also not affected by obfuscation, in fact, the more frequently you mutate the code, the more likely you are to get a block.
Click to expand...
Can I interpret your above statement to mean Voodooshield and or PCmatic would fix this or be the solution?
 
  • Like
Reactions: simmerskool
rashmi said:
Panic erupted when @cruelsister's "BEAR" bomb went off... Everyone's frantically searching for the defuse button—PAWS the unBEARable chaos... HUG COMODO! 😊
Click to expand...

It is rather like a video clip about a bear attacking a man in Alaska. People are frightened even on Sahara.
 
  • HaHa
  • Like
Reactions: Halp2001, Khushal, Miravi and 5 others
Parkinsond said:
God knows which one will work, but at least I seek the one with higher odds to work.
Mercedes works, Lada also works, but if I can afford, I will seek Mercedes.
Click to expand...
@Shadowra should test the various deny-by-default products head to head, including some of the 139 known malicious file types, along with a false positive / usability test.

Then we will all know which ones drive like a Mercedes ;).
 
  • Like
  • Hundred Points
Reactions: Halp2001, ErzCrz, simmerskool and 2 others
danb said:
@Shadowra should test the various deny-by-default products head to head, including some of the 139 known malicious file types, along with a false positive / usability test.

Then we will all know which ones drive like a Mercedes ;).
Click to expand...
He needs a license for PCMatic
 
Jonny Quest said:
Is there any browser extension, any AV browser extension, NextDNS filter setting (Block NRD's) that would have the potential to stop this type of exploit at the browser level, as this file was already on the desktop?
Click to expand...
They are all reputation-based blocking or detection and filtering. Same goes with DNS, which is filtering and there's a lot of wonkiness to it. It is not anywhere near the simplistic assumptive thinking of the average human - even the "advanced users." In other words, there's nothing that you can really depend upon with a high level of confidence as far as browser extensions.

The only way to cover the most potential threats and survive is default deny and knowledge.

One can adopt and adhere to a high effective manual security process, but most people just want to install something and call it a day because they expect software to do it all for them.

Froggy_Shrug.gif
 
  • Like
  • Thanks
Reactions: Halp2001, simmerskool and Jonny Quest

You may also like...