Mylobot Malware Brings New Sophistication to Botnets

The malware pulls together a variety of techniques to gain a foothold and remain undiscovered.

Cybercriminals looking to maximize their investments are using evermore sophisticated software techniques and increasingly aggressive steps against their fellow malware authors. Those are among the conclusions by researchers at Deep Instinct about a new strain of malware found within the last two months.
The new malware, dubbed Mylobot, pulls together a variety of techniques to gain a foothold and remain undiscovered. Among the strategies employed are:
Anti-VM techniques
Anti-sandbox techniques
Anti-debugging techniques
Wrapping internal parts with an encrypted resource file
Code injection
Process hollowing (a technique where an attacker creates a new process in a suspended state and replaces its image with the one that is to be hidden)
Reflective EXE (executing EXE files directly from memory, without having them on disk)
A 14-day delay before accessing its C&C servers.
On a daily basis we come across dozens of highly sophisticated samples, but this one is a unique collection of highly advanced techniques, says Arik Solomon, vice president of R&D at Deep Instinct. Each of the techniques is known and used by a few malicious samples, but the combination is unique.
Solomon noted that Mylobot — named for a researchers dog — is a downloader: It can be purposed to download and install any type of payload, from spambot or DDoS engine to keylogger or banking Trojan. I think that what we see here is the productization or even industrialization of malware techniques, says Tom Nipravsky, security researcher at Deep Instinct.
That industrialization aspect fits with what Solomon sees as the driving force behind this new malware. It always comes down to money, he says. And thats especially true given one of Mylobots behaviors: It seeks out and shuts down competing botnet software.
We see the capability to make sure you have no competition, Solomon says, noting that in the highly unregulated world of malware, having more infected systems at your disposal than the competition can offer might be a matter of millions of dollars.
Mylobot leverages several techniques to make sure no other botnet is active on a machine it infects. Usually we see this behavior when malware tries to shut down defensive software, Solomon notes. In this case, its fighting against its competition.
Though the researchers have been looking at Mylobot for several weeks, they arent yet ready to say who the author is. There are some clues, though, including the fact that Mylobot scans for keyboard layout of an infected machine and doesnt execute if it finds an Asian character set and layout in use. Nipravsky says this could have to do with encryption algorithms, but it might well speak to the geographical nexus of the malware.
The researchers say its important to note that Mylobot was found in the wild, at a Tier 1 data communication and telecommunication equipment manufacturer, not in a proof-of-concept demonstration.
Its a relatively good representative of what we see on the Dark Web where people are selling platforms for others to use, Solomon says. Customers of the botnet can rent time to download and run their own payloads, making this a very efficient use of malware technology.
One thing the researchers are confident about is the sophistication of the malwares authors. This presents itself as a product that we all could be envious of, Nipravsky says. The integration, how it operates, how it was developed by different teams around the world, the different layers all combine to create a single malicious product.
Related Content:
7 Variants (So Far) of Mirai
Olympic Destroyer Reappears in Attacks on Europe, Russia
8 Ways Hackers Can Game Air Gap Protections
How to Prepare for WannaCry 2.0
Why Cybercriminals Attack: A DARK READING VIRTUAL EVENT Wednesday, June 27. Industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Go
here
for more information on this free event.

Last News
▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Mylobot Malware Brings New Sophistication to Botnets