Malware News Top 5: Things to know about fileless attacks

[cruelsister]

Good to know since much of this discussion is above my pay grade & I use CF

Yeah, CF pretty much will just blow stuff like this away on initial run, no matter what the initial vector (it can be something like an exploit from a website, an actual malware payload, or (my Favorite) coding in the malware into a legitimate application (not that I would know anything about this, being Kind and Gentle).

However if one installs CF on a compromised system, one MUST initially place the fireWall on the "Custom Ruleset" Mode. This will block the OutBound transmission constantly.



(the above is when you install CF on and infected system. Think Windows Firewall would have given you a peep?) The cool thing about this sort of malware is that one can time the activation- You can specify it runs once a month, once a week, or like in the malware that I used for the above screenshot was re-coded to Activate every 15 seconds. The Monthly activation is a real Pain for analysis, as one sees many times that an actual infected file is marked as clean due to the Sleep function).

Anyway, malware like this has been out for a number of years (initially coded by our Friends living in the Steppes of Central Asia) and is problematic for many reasons. The way to stop this crap is actually quite intuitive- either stop the initial vector (not likely for a true zero-day), stop the OutBound transmission, or look into the place where the persistence (ie- starting with each System start) mechanism was put in place (normally WMI Root).

This is actually an issue for a number of Security Applications- of the major Second Opinion Scanners (MB, HMP, EEK, Norton PE) only HMP detects and stops the Persistence (Fun Fact- although many seem to feel that if a 2nd opinion scanner finds no malware extent that the system is clean. Actually a "Clean" report just means that it has not found all of the things it was programmed to find, and God alone knows about anything else). Of the major AV's, things like Avira, Avast/AVG/FortiClient are Oblivious to it. Kaspersky will detect it, but that may be because (LIBEL ALERT!!!!!) they initially coded it.



Andy- I don't know if I would steer anyone trying to learn to go to Wilders. They seem to have preconceived notions and cannot be dissuaded from them. They will discuss if the latest portable build of CCleaner is legit until the Cows come Home, but when confronted by information that things like MB, HMP. EAM (their favs) are totally ineffective for worms- not a peep...

 

[Deleted member 65228]

Wilders Security is for people who want overkill security configs while fantasizing about becoming James Bond.

 

[cruelsister]

God, I wish I had posted that (Damn)!

 

[Deleted member 65228]

Damn the original post I made

I had to force myself to censor it so I don't find a pack of wolves taking it apart and talking about "MalwareTips" with CompTIA avatars

 

[Sunshine-boy]

coding in the malware into a legitimate application

Like what?what does that mean?and how can i protect myself from this?!

 

[oldschool]

@cruelsister you amaze....! Too cruel!

 

[Andy Ful]

@cruelsister & @Opcode
I think that posts on both forums should be considered as a starting point, because members' opinions are so different, even when reading a single thread. But, many posts include links to interesting source articles and there are some very interesting threads (some from 10 years ago) on both forums. I think that it is better to read MalwareTips & Wilderssecurity than only MalwareTips.
I usually do not rely on members' posts/opinions (with some exceptions) but rather on sources, so I do not know which forum would be better for most users.
But, I also like that both of you post most on MalwareTips forum.

 

[Andy Ful]

Wilders Security is for people who want overkill security configs while fantasizing about becoming James Bond.

I agree, but many MalwareTips members are only one step behind them.
That is normal. After many experiments and some learning, most of them will settle eventually for something simple and efficient.

 

[shmu26]

There is a lot of intelligent discussion going on at Wilderssecurity. Just weed out the ignorant, opinionated posts, the same as you do on this forum.