Dexphot Polymorphic Malware Demos Complexity of Everyday Threats

guest · Nov 26, 2019

Dexphot Polymorphic Malware Demos Complexity of Everyday Threats
November 26, 2019
https://www.bleepingcomputer.com/ne...malware-demos-complexity-of-everyday-threats/

Ordinary malware can be a real nuisance to detect due to complex methods that allowed it to slip past security solutions. Dexphot is one such strain that managed to run attack routines on close to 80,000 machines earlier this year.

The threat had a surge in mid-June this year, when it landed on tens of thousands of computers. Towards the end of the month the attacks subsided, less than 20,000 machines exhibiting Dexphot activity. By the end of July, the malware was seen on less than 10,000 machines every day.
The polymorphic threat
Some of the files deployed by Dexphot would change every 20 or 30 minutes, making it difficult to track its activity. Delivered as an MSI executable, the package contained a variety of files that were different from one infection to another.

All components are refreshed this way each time the system is rebooted and every 90 or 110 minutes while the machine is running.

"Detecting malicious code hidden using this method is not trivial, so process hollowing has become a prevalent technique used by malware today," Kim writes in a report today.
Click to expand...

Microsoft: Insights from one year of tracking a polymorphic threat

Log in or Sign up

Dexphot Polymorphic Malware Demos Complexity of Everyday Threats

guest Guest

Log in or Sign up

Dexphot Polymorphic Malware Demos Complexity of Everyday Threats

guest Guest

Useful Searches