This Malware Might Be Undetectable To Some Antivirus Programs

February 23, 2021

Written by wukovits

For a time, a few months ago, it seemed like the gang behind the dreaded Trickbot network and malware was on the ropes. Law enforcement had rocked the group back on its heels and confiscated or shut down large swaths of its network and it appeared that the group wasn’t long for the world.

Rumors of their death, it seems, have been greatly exaggerated.

The gang has proved to be highly adaptive, and they’ve responded to the recent attacks made by law enforcement and IT security professionals by changing their game.

One of the most recent changes they’ve made is the rewrite of their BazarBackdoor malware. By rewriting the code in a little-known language called Nim, they’ve been able to make the malware even harder to detect. Vitali Kremez is the CEO of an internet security firm called Advanced Intel.

Kremez had this to say about the recent discovery:

“The backdoor component that is capable of command execution is written in NIM programming language to evade anti-virus detection. The crime group likely chose to pursue the lightweight malware development in Nim to frustrate anti-virus and detection mechanism focused on traditional binaries compiled in C/C++ style languages.

Not too long ago, Golang has become another preferred language of choice for some malware families including RobbinHood ransomware majorly due to the fact that many anti-virus products fail to process and characterize unconventional binaries as malware due to unique section and binary content introduced by the Nim and similar exotic languages.”

It’s also worth mentioning that BazarBackdoor isn’t the first malware to be written in Nim and other little-known languages. Researchers don’t stumble across many such examples but at least a few others are known to exist. For instance, in 2019 the MalwareHunterTeam found a ransomware strain called XCry written in Nim, and just last month, Advanced Intel discovered a new ransomware strain written in a programming language called “D.” Given that, it seems we have yet another new thing to worry about.

Used with permission from Article Aggregator

Bayou Tech

We provide solutions for your business. Find out how we can help.

Related Articles

New Graphene Technology May Increase Hard Drive Storage

HDDs are old, well understood technology. They haven't changed much in recent years. In fact, increasingly, people are writing them off, preferring SSDs for their greater speed and smaller size, even though HDDs are less expensive. The clever folks at the University...

Some Amazon Device Features May Have Security Risks

Have you heard of Amazon Sidewalk? If not, it's definitely something you should be aware of. Depending on your point of view, the new feature, which was enabled by default on a wide range of Amazon devices by default on June 8 of this year (2021) is either...

Email Unsubscribe Scam Can Easily Fool Any User

Scammers are increasingly relying on a tried and true bit of social engineering to fool unsuspecting users into unwittingly signing up to receive a flood of additional spam email. They accomplish this by blasting out an email asking recipients if they wish to...

Send us a message

Your message was sent.