4 ms·
Modern malware is so often quite boring. Like this one, it doesn't actually perform any interesting attacks on its own, it just uses bog-standard autorun for pe
by zokier 5y ago
Modern malware is so often quite boring. Like this one, it doesn't actually perform any interesting attacks on its own, it just uses bog-standard autorun for persistence and generic names to obfuscate its presence. Nothing particularly sophisticated or technically impressive imho.
- ancode 5y agoWhy blow the interesting stuff on generic targets
- ASalazarMX 5y agoThis is why we can't have nice malware.
- ReactiveJelly 5y agoYeah. If the article is right, SysJoker is "stage 1" to infiltrate networks. The C&C servers will only deploy a more interesting "stage 2" to the target they care about. Maybe the attack is already completely done, and they're just leaving the C&C servers and the rest of the botnet up to avoid leaking "The C&C servers went offline at X time" as a piece of information.
- 323 5y agoYou want to look as "boring and regular app" as possible, to avoid detection based on heuristics. So that means using no "malware techniques" like DLL injection, process scanning, fancy persistence, ...
- taneq 5y agoDon't dress like Seal Team Six and abseil in through the skylight, just dress like you're in IT, walk fast and carry a clipboard.
- the_only_law 5y agoHah yeah, I have had the same observation as well, but as other replied noted this makes sense. I’ve also noticed I don’t really find much malware in the wild, at least nothing targeting you’re typical PC user. Maybe I’ll find some boring, barely obfuscated adware, but of it seems to target larger, enterprise organization, which I suppose also makes sense. There was a write up a few days ago about an exploit targeting MS Word that was at least mildly more interesting than most of the stuff I hear about now.