DGA.Changer Gets Anti-Detection Upgrade

New imitation game feature helps botnet-for-rent fool security tools that use sandboxing.

DGA.Changer has added a new trick to its arsenal: a technique to fool security tools into thinking theyve captured it while its already slipped away, according to new research from Seculert.
DGA.Changer is a botnet-for-rent used for click fraud campaigns, information-stealing, and delivering remote access Trojans, and is sold for targeted purposes as well.
It uses an infinite domain generation algorithm (DGA), plus the command-and-control server can send issue commands to the bots to change the DGA seed (hence the name). This always made it difficult to detect, because as Seculert described when
first detailing the malware in 2013
, the initial sample will reveal the domain name streams before the change — which no longer resolve to the C2 server.
Recently, the malware writers have taken those anti-detection capabilities even further.
“A new feature they added several months ago is if they detect they are in a virtualized environment like a sandbox, they generate a fake stream,” says Aviv Raff, CTO of Seculert.
DGA Changer will look for evidence of VMWare, Virtual Box and other virtualization products to check whether or not the malware is runing within a virtual machine. If so, it alters the DGA seed, communicates with the fake domains, and downloads an executable file -- but that executable does nothing more than exit after being executed.
In other words, all that’s in the sandbox is a decoy, Raff says.
As Raff wrote, the goal here seems to be to fool sandbox solutions and/or researchers into believing the malware is fully functional and downloading additional components. ... The discovery of this new version of DGA.Changer highlights yet again the limitations of sandbox only prevention approaches and the need to complement them with post-infection analytics based detection techniques.
Kelly Jackson Higgins contributed to this story.

Last News
▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security	▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security	▸ Senate wants changes to cybercrime law. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
DGA.Changer Gets Anti-Detection Upgrade