Trojan horse malware destroys delivery files to hide its tactics

[Jack]

Microsoft has discovered an unusually stealthy Trojan capable of deleting files it downloads in order to keep them away from forensics investigators and researchers.

The Trojan downloader, called Win32/Nemim.gen!A, is the latest example of how malware writers are using sophisticated techniques to protect their own trade secrets. The Trojan essentially makes downloaded component files irrecoverable, so they cannot be isolated and analyzed.

"During analysis of the downloader, we may not easily find any downloaded component files on the system," Jonathan San Jose, a member of Microsoft's Malware Protection Center, said in a blog post. "Even when using file recovery tools, we may see somewhat suspicious deleted file names but we may be unable to recover the correct content of the file."

Microsoft managed to grab some components as they were being downloaded from a remote server. The malware's two purposes was to infect executable files in removable drives, and to unleash a password stealer to snatch credentials from email accounts, Windows Messenger/Live Messenger, Gmail Notifier, Google Desktop, and Google Talk.,

Typically, downloaders' only job is to deliver the core malware. In this case, the downloader delivered the malware and continued to be an integral part of the operation.

Read more: http://www.pcworld.com/article/2036030/trojan-horse-malware-destroys-delivery-files-to-hide-its-tactics.html

 

[Gnosis]

Nice post Jack.

Thank goodness for BB, HIPS and Sandboxing technology.
I knew something like this would be on the horizon, and if the trend gets malignant, then expect signature based scanners and signature based realtime malware detectors to be obsolete within a couple of years.
That is quite a game changer.
I like TF and Sandboxie more and more every day; simple, free, and secure with no slowdowns during boot time or otherwise.

NEXT ON THE HORIZON: Look for signature based PC security to get more expensive, and free versions to require some payments due to legit AV creators needing to go rogue in order to steal formerly hidden and deleted malware information from illegitimate hackers' computer databases. They will have to double their hacker work forces with some malicious espionage of their own. You will probably see them needing to hack the Kremlin, Russian Defense Ministry, State Department, etc. in order to keep up with threats since honey-pots will become useless.

 

[jamescv7]

Oh well those type of vectors are nothing new and rare prevalence for a user to be infect (depends where the source could get it) however the problem most AV's were bypass from analyze when fact they could do complication process to make sure the protection guarantees.

No perfect but almost perfect can be.

 

[illumination]

As malware advances, and has advanced, it will be layered approaches that work best to thwart their progress. I have/do believe this approach to be the best method of defending ones system.

 

[Ink]

If the downloaded components are programmed to be deleted (ie. irrecoverable), then (I may be wrong) a Behaviour Blocker or HIPS doesn't query the user whether you want to allow the deletion process?

Also could it fool any auto-sandbox analysis process?

 

[Gnosis]

Excellent point Earth.
I would be willing to bet that while a BB may not catch it unless custom settings were applied for such events, HIPS would.

I am thinking of tweaking Threatfire, with custom rules, for exactly that reason:

http://www.wilderssecurity.com/showthread.php?t=183020

 

[Ramblin]

Thank goodness for BB, HIPS and Sandboxing technology.

If we run our browsers and EMail clients or open USB drives in a restricted sandbox, the threat described in the article wont do nothing as long as we don't recover the downloader to our real system. One more reason to start using the sandbox.

Bo

 

[jamescv7]

Some viruses have the ability to detect when its been sandbox and make itself inoperable however difficult for bypass since sandbox application have the strongest code as possible with features of prevent privileges.