Wolf in sheep’s clothing: how malware tricks users and antivirus

guest · Aug 2, 2022

Deception at Scale: How Malware Abuses Trust
August 2, 2022

One of the primary methods used by malware distributors to infect devices is by deceiving people into downloading and running malicious files, and to achieve this deception, malware authors are using a variety of tricks.

Some of these tricks include masquerading malware executables as legitimate applications, signing them with valid certificates, or compromising trustworthy sites to use them as distribution points.
According to VirusTotal, a security platform for scanning uploaded files for malware, some of these tricks are happening on a much larger scale than initially thought.
Click to expand...

The platform has compiled a report presenting stats from January 2021 until July 2022, based on the submission of two million files daily, illustrating trends in how malware is distributed.
Using stole code-signing certificates
Of all the malicious samples uploaded to VirusTotal between January 2021 and April 2022, over a million were signed, and 87% used a valid certificate.

The most common certification authorities that are used to sign the malicious samples submitted to VirusTotal include Sectigo, DigiCert, USERTrust, and Sage South Africa.
Click to expand...

Disguised as popular software
Masquerading a malware executable as a legitimate, popular application has seen an upward trend in 2022.
Victims download these files thinking they’re getting the applications they need, but upon running the installers, they infect their systems with malware.

The most mimicked applications (by icon) are Skype, Adobe Acrobat, VLC, and 7zip.
Click to expand...

Lacing legitimate installers
Finally, there’s the trick of hiding malware inside legitimate application installers and running the infection process in the background while the real apps execute in the foreground.

This process helps in tricking the victims and also evades some antivirus engines that don’t scrutinize PR resource structure and content in executables.
Based on VirusTotal stats, this practice also appears to be on the rise this year, using Google Chrome, Malwarebytes, Windows Updates, Zoom, Brave, Firefox, ProtonVPN, and Telegram as lures.
Click to expand...

VirusTotal: Deception at a scale

We encourage you to read the full report, but below you can find some of the main findings:

Ten percent of the top 1,000 Alexa domains have distributed suspicious samples.

0.1 percent of legitimate hosts for popular apps have distributed malware.

87% of the more than one million signed malicious samples uploaded to VirusTotal since January 2021 have a valid signature.

In a growing social engineering trend, 4,000 samples either executed or were packed with legitimate apps installers.

There has been a steady increase in the number of malware visually mimicking legitimate applications, with Skype, Adobe Acrobat, and VLC comprising the top three.

98% of samples, including legitimate installers in their PE resources, were malicious.

Click to expand...

Deception at Scale: How Malware Abuses Trust
(PDF): https://assets.virustotal.com/reports/2022deception.pdf

EASTER · Aug 3, 2022

It's a deluge of epic proportions no doubt. AV's alone are simply no match-the classic layering approach is as important as ever before as well as trustworthy virtualization apps to offer containment which can simply dump them on reboot or within the program. Stealer keyloggers are on the rise as well which requires another field of defense against.

Rasheed187 · Aug 15, 2022

This is indeed always a risk on any PC, but what do they suggest, that we should all switch to a standard app store like on Linux and macOS? In general, you won't encounter malware if you download software that is listed on the more popular download sites, but you can never be sure and hackers are getting more tricky as seen in this report.

Log in or Sign up

Wolf in sheep’s clothing: how malware tricks users and antivirus

guest Guest

EASTER Registered Member

Rasheed187 Registered Member

Log in or Sign up

Wolf in sheep’s clothing: how malware tricks users and antivirus

guest Guest

EASTER Registered Member

Rasheed187 Registered Member

Useful Searches