Using legitimate tools to hide malicious code

Minimalist · Nov 8, 2017

The authors of malware use various techniques to circumvent defensive mechanisms and conceal harmful activity. One of them is the practice of hiding malicious code in the context of a trusted process. Typically, malware that uses concealment techniques injects its code into a system process, e.g. explorer.exe. But some samples employ other interesting methods. We’re going to discuss one such type of malware.
Click to expand...

https://securelist.com/using-legitimate-tools-to-hide-malicious-code

itman · Nov 8, 2017

Interesting they would mention Casey Smith:

The technique was described by information security researcher Casey Smith aka subTee (Proof of Concept). Briefly, the console utility InstallUtil.exe runs a malicious .NET assembly, bypassing the entry point of the assembly; all malicious activity is then hidden in the context of the trusted process.
Click to expand...

Guess Kaspersky doesn't realize he has went "dark" since the posted POC link doesn't work.

Rasheed187 · Nov 11, 2017

This once again shows how important firewalls are. It doesn't really matter which process is being hijacked, as long as it can't connect out. Obviously, it only makes sense to hijack processes that need outbound access in order to function like the browser and svchost.exe, but all other system processes need to be blocked from network access.

Log in or Sign up

Using legitimate tools to hide malicious code

Minimalist Registered Member

itman Registered Member

Rasheed187 Registered Member

Log in or Sign up

Using legitimate tools to hide malicious code

Minimalist Registered Member

itman Registered Member

Rasheed187 Registered Member

Useful Searches