New Adware Uses Interesting Technique To Avoid Detection

August 22, 2019

Written by wukovits

new adware uses interesting technique to avoid detectionBeing more of a nuisance than anything, adware doesn’t see as many innovations as other forms of malware. Once in a while, an adware developer surprises the security researchers.

That happened recently when two researchers working for enSilo discovered an innovation in an adware strain, known as DealPly.

As Adi Zeligson and Rotem Kerner indicated in a recent blog post, DealPly has some interesting features bolted on, which make it much more adept than most other forms of adware at avoiding detection by antivirus programs.

The adware is typically installed on a target’s machine by being bundled with a legitimate app.  Once it’s installed, it will add itself to the Windows Task Scheduler and run every hour.  Each time it runs, it will contact its command and control server and request instructions.

Here’s where things get interesting. DealPly was designed modularly and makes use of Virtual Machine Detection and Machine Fingerprinting techniques.

Microsoft SmartScreen is one of two major systems used to verify the risk of files and web addresses.  It’s updated regularly with newly blacklisted sites.  Naturally, malware authors find this to be a problem because it only gives them a limited window of time before their code and malicious URLs wind up on the list.

DealPlay, however, contains code that seems to be based on a reverse-engineering of Microsoft SmartScreen. When it contacts its command and control server, it requests a list of hashes and URLs to query using the SmartScreen reputation server. Once it has its list of queries to make, it will send a JSON request to the SmartScreen API to see if the server will respond with any of the following:

  • UNKN Unknown URL/File
  • MLWR Malware related URL/File
  • PHSH Phishing related URL/File

Essentially, this query allows DealPly to know whether it has been blacklisted.  If so, the software enters an idled state until it can be updated.  This allows DealPly’s developers a something close to real-time mechanism to know when they need to update their code, allowing them to stay ahead of the curve.  Very clever.  Very clever indeed, and troubling to IT staff everywhere.  We can expect this technique to be copied by other malware developers, worldwide.

Used with permission from Article Aggregator

Bayou Tech

We provide solutions for your business. Find out how we can help.

Related Articles

Key Considerations for Effective Cybersecurity Implementation

Consider this: In the realm of cybersecurity, things often get tangled in the web of "you should do it anyway" arguments. Yet, for busy business owners bombarded with daily "must-dos," deciphering the essentials from the fluff can feel like a cyber maze. We aim to...

Unlocking Small Business Success: The Impact of AI in a Digital Era

In the rapidly evolving business landscape, staying competitive necessitates embracing technological advancements. Artificial Intelligence (AI), once perceived as a luxury for larger enterprises, is now accessible to small businesses, offering new opportunities for...

Major Cyber Attack at OMV

Louisiana’s Office of Motor Vehicles (OMV) is one of a still undetermined number of government entities, major businesses, and organizations to be affected by an unprecedented Data Breach.There is no indication at this time that cyber attackers who breached MOVEit...