McMcbrad
Level 23
- Oct 16, 2020
- 1,272
When vulnerability is thrown in the mix, one usually expects to read about privilege escalation/arbitrary code execution, etc.
However, if we define vulnerability as design or implementation error that can compromise the confidentiality, integrity or availability of information, this broadens the scope.
I am creating this thread after I have noticed that 2 samples successfully bypassed all layers of Trend Micro (except web-protection/anti-spam, as I have downloaded from a malware repository).
Both samples were Parralax RAT which is quite malicious and works by injecting/process hollowing Notepad.exe.
It also drops a copy of itself in %AppData%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\citrix.exe
Today's sample SHA2 is 723cb0067010b79e0cc780ea786fef8c6c17b68c383acc8183b2ae7332e95abf.
VT 49/70.
Normally Trend Micro issues a prompt when executing something not-so-trustworthy, which looks like this:
The blocked program contains the following code, which can't be malicious, meaning the prompt is most likely based on signature and file prevalence:
However in the signed malware case, this alert is not presented and behavioural blocking does nothing to stop the malware in question.
I have contacted Trend Micro and will update this thread when I have more information.
Though it does good job blocking many other vectors, signed malware is a growing problem and is not to be overlooked.
However, if we define vulnerability as design or implementation error that can compromise the confidentiality, integrity or availability of information, this broadens the scope.
I am creating this thread after I have noticed that 2 samples successfully bypassed all layers of Trend Micro (except web-protection/anti-spam, as I have downloaded from a malware repository).
Both samples were Parralax RAT which is quite malicious and works by injecting/process hollowing Notepad.exe.
It also drops a copy of itself in %AppData%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\citrix.exe
Today's sample SHA2 is 723cb0067010b79e0cc780ea786fef8c6c17b68c383acc8183b2ae7332e95abf.
Normally Trend Micro issues a prompt when executing something not-so-trustworthy, which looks like this:
The blocked program contains the following code, which can't be malicious, meaning the prompt is most likely based on signature and file prevalence:
C++:
int main()
{
cout << "Hello World!\n";
int mem[3] = { 1,2,3 };
for (int i = 0; i < 3; ++i) {
cout<< mem[i]<<endl;
}
}However in the signed malware case, this alert is not presented and behavioural blocking does nothing to stop the malware in question.
I have contacted Trend Micro and will update this thread when I have more information.
Though it does good job blocking many other vectors, signed malware is a growing problem and is not to be overlooked.
Last edited:
