4 ms·

Making Finfisher Malware Undetectable

23 points by lqdc13 12y ago

nekitamo 12y ago
The name of one of the protectors is 'Themida', not "Themeda". Aside from that, nice article. I wonder how many of the antiviruses complained when you actually tried to execute your packed file? There should be a second round of heuristics then which would catch the malware after it's unpacked to disk.
- moyix 12y ago
  Do you mean unpacked in memory? Most packers don't write unpacked files to disk (it would make bypassing them a lot easier if they did...)
Fizzadar 12y ago
Kind of scary, but would need successful execution to be really bad. I really like the idea of sandbox analysis, as well as the challenge of writing a program which can detect when running in-sandbox :)
iancarroll 12y ago
To be clear, running any sample that's clean on VT will probably trigger your AV based on many run-time heuristics - VT is showing scan-time results, not run-time results. These 'crypters' are also effectively worthless - as soon as your sample hits a few computers an AV will upload the sample (or someone will upload it to VirusTotal, and it will subsequently get analyzed) and it will be flagged. You can almost try this 'at home' - upload a file to VirusTotal and try to get it to match two or three AV's detections. It will then be flagged by at least ten AVs next week. This is because VirusTotal shares all uploaded files with antivirus products.
- lqdc13 12y ago
  You can see that the file that got flagged in September still isn't flagged by all AVs: https://www.virustotal.com/en/file/e2b8ecc843fa8156a8c06e7d9f6daf07ccacfd653450615f82f8a691d3a9ecfd/analysis/ https://www.virustotal.com/en/file/e2b8ecc843fa8156a8c06e7d9... Another example: This one marked by 2 AVs (malwarebytes and Bkav) in September. A month later it was only marked by 3. https://www.virustotal.com/en/file/e5712fc604d6285038c6a7fe254ed2b05a1098a86b6ac3e654cf9978739ae704/analysis/ https://www.virustotal.com/en/file/e5712fc604d6285038c6a7fe2...
- Terr_ 12y ago
  I remember reading some fictional story where the hacker designed a easily-detectable virus, whose true payload was the signature the AV system generated from it. The carefully-crafted signature would exploit a buffer-overflow in the anti-virus clients as soon they got their regular updates from the central server. Far-fetched but not impossible. I wish I could remember the source.

23 points by lqdc13 12y ago

The name of one of the protectors is 'Themida', not "Themeda". Aside from that, nice article. I wonder how many of the antiviruses complained when you actually tried to execute your packed file? There should be a second round of heuristics then which would catch the malware after it's unpacked to disk.

moyix 12y ago
Do you mean unpacked in memory? Most packers don't write unpacked files to disk (it would make bypassing them a lot easier if they did...)

Fizzadar 12y ago

Kind of scary, but would need successful execution to be really bad. I really like the idea of sandbox analysis, as well as the challenge of writing a program which can detect when running in-sandbox :)

iancarroll 12y ago

To be clear, running any sample that's clean on VT will probably trigger your AV based on many run-time heuristics - VT is showing scan-time results, not run-time results. These 'crypters' are also effectively worthless - as soon as your sample hits a few computers an AV will upload the sample (or someone will upload it to VirusTotal, and it will subsequently get analyzed) and it will be flagged. You can almost try this 'at home' - upload a file to VirusTotal and try to get it to match two or three AV's detections. It will then be flagged by at least ten AVs next week. This is because VirusTotal shares all uploaded files with antivirus products.

lqdc13 12y ago
You can see that the file that got flagged in September still isn't flagged by all AVs: https://www.virustotal.com/en/file/e2b8ecc843fa8156a8c06e7d9f6daf07ccacfd653450615f82f8a691d3a9ecfd/analysis/ https://www.virustotal.com/en/file/e2b8ecc843fa8156a8c06e7d9... Another example: This one marked by 2 AVs (malwarebytes and Bkav) in September. A month later it was only marked by 3. https://www.virustotal.com/en/file/e5712fc604d6285038c6a7fe254ed2b05a1098a86b6ac3e654cf9978739ae704/analysis/ https://www.virustotal.com/en/file/e5712fc604d6285038c6a7fe2...
Terr_ 12y ago
I remember reading some fictional story where the hacker designed a easily-detectable virus, whose true payload was the signature the AV system generated from it. The carefully-crafted signature would exploit a buffer-overflow in the anti-virus clients as soon they got their regular updates from the central server. Far-fetched but not impossible. I wish I could remember the source.