DealPly Adware Abuses Microsoft Smartscreen to Boost AV Evasion

guest · Aug 1, 2019

DealPly Adware Abuses Microsoft Smartscreen to Boost AV Evasion
Augsut 1, 2019
https://www.bleepingcomputer.com/ne...es-microsoft-smartscreen-to-boost-av-evasion/

Security researchers have uncovered a new DealPly variant which uses a new method to avoid detection by abusing the reputation services provided by Microsoft's SmartScreen and McAfee's WebAdvisor.

DealPly is an adware strain that would typically install browser extensions designed to display advertisements in the victim's browser. It also features "modular code, machine fingerprinting, VM detection techniques and robust C&C infrastructure" according to enSilo researchers who discovered this new variant.
Abusing the SmartScreen API
If a Windows user tries to access a malicious domain or app, a warning will be shown to recommend proceeding with caution.

To avoid being blacklisted by Microsoft while querying its reputation service, DealPly will take advantage of the machines it manages to infect and will use them as a "distributed network of machines for harvesting this data."

"It is important to note that the SmartScreen API is undocumented. This means the author has put a lot of effort in reverse engineering the inner workings of the SmartScreen mechanism\feature," says enSilo.
Click to expand...

enSilo: DealPly Revisited: Leveraging Reputation Services To Remain Under The Radar

Rasheed187 · Aug 3, 2019

Interesting stuff, so it's possible to bypass SmartScreen. Another M$ blunder.

Log in or Sign up

DealPly Adware Abuses Microsoft Smartscreen to Boost AV Evasion

guest Guest

Rasheed187 Registered Member

Log in or Sign up

DealPly Adware Abuses Microsoft Smartscreen to Boost AV Evasion

guest Guest

Rasheed187 Registered Member

Useful Searches