New Loader Variant Behind Widespread Malware Attacks

guest · Jul 25, 2019

New Loader Variant Behind Widespread Malware Attacks
Malware infection technique called TxHollower gets updated with stealthy features
July 25, 2019
https://threatpost.com/new-loader-variant-behind-widespread-malware-attacks/146683/

Behind a recent wave of cyberattacks, pelting PCs with FormBook, LokiBot, SmokeLoader malware, is an updated version of a malware-loading technique called TxHollower. It is described as a new “significant threat”, according to researchers, who added, attacks using TxHollower have “spread like wildfire” over the past year.

Ensilo researchers, tracking TxHollower, said on Thursday, part of the uptick is tied to improved features that allow adversaries to more effectively sneak malware past some antivirus software defenses.
TxHollower is what is known as a malware loader, a type of malicious code that specializes in loading a second-stage malware payload onto a victim’s system.

TxHollower is a hybrid of sorts, using techniques borrowed from two loader-malware families called Process Doppelgänging and second called Process Hollowing.
The ability of the TxHollower technique to sneak malware past security measures represents a significant threat, Yavo said. It’s not surprisingly this technique has quickly been seized upon by attackers, he said.
Click to expand...

Ensilo: GandCrab Doppelgänged His Shell?

During an analysis we conducted while tracking GandCrab ransomware, one of the more notorious malware families in 2018 and 2019, we noticed an interesting behavior. In some cases, it seemed to have been using Process Hollowing as part of its attack chain.

Usage of process doppelgänging-like techniques in-the-wild is increasing, which may suggest that not all security products have adopted and are not yet able to detect or prevent them.
Click to expand...

Log in or Sign up

New Loader Variant Behind Widespread Malware Attacks

guest Guest

Log in or Sign up

New Loader Variant Behind Widespread Malware Attacks

guest Guest

Useful Searches