New Adware Uses Interesting Technique To Avoid Detection

August 22, 2019

Written by wukovits

Being more of a nuisance than anything, adware doesn’t see as many innovations as other forms of malware. Once in a while, an adware developer surprises the security researchers.

That happened recently when two researchers working for enSilo discovered an innovation in an adware strain, known as DealPly.

As Adi Zeligson and Rotem Kerner indicated in a recent blog post, DealPly has some interesting features bolted on, which make it much more adept than most other forms of adware at avoiding detection by antivirus programs.

The adware is typically installed on a target’s machine by being bundled with a legitimate app.  Once it’s installed, it will add itself to the Windows Task Scheduler and run every hour.  Each time it runs, it will contact its command and control server and request instructions.

Here’s where things get interesting. DealPly was designed modularly and makes use of Virtual Machine Detection and Machine Fingerprinting techniques.

Microsoft SmartScreen is one of two major systems used to verify the risk of files and web addresses.  It’s updated regularly with newly blacklisted sites.  Naturally, malware authors find this to be a problem because it only gives them a limited window of time before their code and malicious URLs wind up on the list.

DealPlay, however, contains code that seems to be based on a reverse-engineering of Microsoft SmartScreen. When it contacts its command and control server, it requests a list of hashes and URLs to query using the SmartScreen reputation server. Once it has its list of queries to make, it will send a JSON request to the SmartScreen API to see if the server will respond with any of the following:

  • UNKN Unknown URL/File
  • MLWR Malware related URL/File
  • PHSH Phishing related URL/File

Essentially, this query allows DealPly to know whether it has been blacklisted.  If so, the software enters an idled state until it can be updated.  This allows DealPly’s developers a something close to real-time mechanism to know when they need to update their code, allowing them to stay ahead of the curve.  Very clever.  Very clever indeed, and troubling to IT staff everywhere.  We can expect this technique to be copied by other malware developers, worldwide.

Used with permission from Article Aggregator

Bayou Tech

We provide solutions for your business. Find out how we can help.

Related Articles

New Graphene Technology May Increase Hard Drive Storage

HDDs are old, well understood technology. They haven't changed much in recent years. In fact, increasingly, people are writing them off, preferring SSDs for their greater speed and smaller size, even though HDDs are less expensive. The clever folks at the University...

Some Amazon Device Features May Have Security Risks

Have you heard of Amazon Sidewalk? If not, it's definitely something you should be aware of. Depending on your point of view, the new feature, which was enabled by default on a wide range of Amazon devices by default on June 8 of this year (2021) is either...

Email Unsubscribe Scam Can Easily Fool Any User

Scammers are increasingly relying on a tried and true bit of social engineering to fool unsuspecting users into unwittingly signing up to receive a flood of additional spam email. They accomplish this by blasting out an email asking recipients if they wish to...

Send us a message

Your message was sent.