RIG EK Still Makes Waves, This Time with a Stealthy Backdoor

guest · May 17, 2018

RIG EK Still Makes Waves, This Time with a Stealthy Backdoor
May 16, 2018
https://threatpost.com/rig-ek-still-makes-waves-this-time-with-a-stealthy-backdoor/132010/

Exploit kit activity has been declining since the latter half of 2016, but the RIG EK seems to buck the trend. It’s been involved in ongoing activity involving a wide range of crimeware payloads; and the latest campaign saw RIG dropping the Grobios malware, which is tailored to be a really stealthy backdoor.

The trojan’s main hallmark is an impressive arsenal of evasion and anti-sandbox techniques, according to FireEye researchers. It also uses multiple anti-debugging, anti-analysis and anti-VM techniques to hide its behavior and C2 traffic.

FireEye researchers said in an analysis on Monday that Grobios’ efforts to evade detection are a grab-bag of tactics: The authors have packed the sample with PECompact 2.xx, for one. Also, the unpacked sample has no function entries in the import table; it uses API hashing to obfuscate the names of API functions it calls; it parses the PE header of the DLL files to match the name of a function to its hash; and, the malware uses stack strings.

“[RIG] is usually never the pioneer to add zero-day exploits, and it only follows after other EKs have already incorporated them,” Gardezi explained.
Click to expand...

Log in or Sign up

RIG EK Still Makes Waves, This Time with a Stealthy Backdoor

guest Guest

Log in or Sign up

RIG EK Still Makes Waves, This Time with a Stealthy Backdoor

guest Guest

Useful Searches