Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 908683" data-attributes="member: 32260">It will be a detection problem for sure like with any new malware family. Some ML modifications are required to fully detect this method.[ATTACH=full]247238[/ATTACH]But there are some things that are special for the above Phantom Malware variant:<ol>
<li data-xf-list-type="ol">Opening the second Desktop by the unknown process (suspicious).</li>
<li data-xf-list-type="ol">Unknown process inserts command to Explorer&#039;s Input box (suspicious).</li>
<li data-xf-list-type="ol">Explorer spawns CMD to run commands (suspicious).</li>
<li data-xf-list-type="ol">Using by CMD a redirected command output into a text file (suspicious).</li>
<li data-xf-list-type="ol">Suspicious API used.</li>
<li data-xf-list-type="ol">etc.</li>
</ol>These suspicious events (in the specific sequence) can be recognized as malicious, after a few successful infections in the wild (postinfection detection).This method could probably avoid detection for a longer time when used not by ransomware, but by spyware.</blockquote>

[QUOTE="Andy Ful, post: 908683, member: 32260"] It will be a detection problem for sure like with any new malware family. Some ML modifications are required to fully detect this method. [ATTACH type="full" alt="1602456606871.png"]247238[/ATTACH] But there are some things that are special for the above Phantom Malware variant: [LIST=1] [*]Opening the second Desktop by the unknown process (suspicious). [*]Unknown process inserts command to Explorer's Input box (suspicious). [*]Explorer spawns CMD to run commands (suspicious). [*]Using by CMD a redirected command output into a text file (suspicious). [*]Suspicious API used. [*]etc. [/LIST] These suspicious events (in the specific sequence) can be recognized as malicious, after a few successful infections in the wild (postinfection detection). This method could probably avoid detection for a longer time when used not by ransomware, but by spyware. [/QUOTE]

Verification