New FormBook Dropper Harbors Obfuscation, Persistence

guest · Jun 12, 2019

New FormBook Dropper Harbors Obfuscation, Persistence
Never-before-seen dropper found in FormBook samples that has increased persistence and obfuscation capabilities
June 12, 2019
https://threatpost.com/new-formbook-dropper-harbors-persistence/145614/

Researchers are warning that a future data-theft attack may be brewing after discovering a new sample of the FormBook malware, with a never-before-seen dropper — i.e. a malicious file that is used in the initial infection stage and installs malware on the system.

“As these droppers evolve and constantly change, they can easily bypass anti-malware products and therefore make data theft much easier for the attackers,” Hod Gavriel with Cyberbit told Threatpost. “I see it as an evolving threat – [FormBook] keeps unveiling new tricks to avoid detection and I think new, even more sophisticated droppers will be created for it.”
New Dropper
However, unlike in other samples, the new dropper doesn’t merely unpack the malware, but instead installs a file that creates two post-infection processes. Those two processes are: A Microsoft HTML Application Host (mshta.exe) and a dropper (Rhododendrons8.exe).
Click to expand...

After it is unpacked, “the final, non-encrypted and non-obfuscated payload of FormBook data-stealing malware never resides on the disk, only in the memory, and therefore makes detection much more difficult,” researchers said.
Continuing Threat
Beyond the dropper, “new targets and motivations [are] unknown as our malware research team does not do attribution intel, but it can definitely be a threat to any user since it is difficult to detect a new dropper written from scratch,” said Gavriel.
Click to expand...

Log in or Sign up

New FormBook Dropper Harbors Obfuscation, Persistence

guest Guest

Log in or Sign up

New FormBook Dropper Harbors Obfuscation, Persistence

guest Guest

Useful Searches