On Sept. 17, the FBI issued a warning about the possibility of cyber attacks on the financial industry. Recently, we observed another kind of an attack (not Distributed Denial of Service or Denial of Service attack) across at least two major financial institutions. The attack, if successful, will result in the establishment of a malicious communication channel on the victim’s computer. The purpose of this blog is to share the finer technical details about the level of obfuscation which was done to hide the malicious executable in the attack.
Author Archives: Michael Vincent
How Advanced Malware Bypasses Process Monitoring
One of the primary aims of an anti-virus (AV) engine is to monitor all process activity—while malware, on the other hand, wants to avoid detection by AV. The philosophy of most rootkits is to run silent and deep, which also aligns with the goals of advanced malware as it evades detection by most enterprise class host-based security solutions (HBSS) and AV.
So how does malware evade detection when starting new rogue processes? Easy—it directly attacks the operating system’s kernel. Microsoft provides the kernel routine PsSetCreateProcessNotifyRoutine to allow security software to monitor process creation and termination events in the Windows kernel, and security software calls the PsSetCreateProcessNotifyRoutine in order to be notified by the kernel when these events occur. These security solutions will then act on process creation and termination events in order to track system activity and protect critical resources.
