Protect your corporate IT network from hackers and other unwanted intruders with Proxy Sentinel™. Click here for all the details and get the peace of mind you deserve.
Back to our Homepage Proxy Sentinel™ high performance Internet proxy server and secure firewall solution Firewall Sentinel™ secure & powerful Internet firewall solution About Internet Security.ca and GCIS Frequently Asked Questions on Internet security issues Internet Security Industry News - Stay informed of what's happening Contact Internet Security.ca today and order your Proxy Sentinel™ or Firewall Sentinel™ server now!

New malware has the ability to evade popular sandboxes

If you need reliability when it comes to SMTP servers, get the best, get Port 587.

Get a powerful Linux Dual-Core dedicated server for less than $2.67 a day!

Share on Twitter.

May 4, 2015

Click here to order the best deal on a HP enterprise dedicated server and at a great price.

A new piece of malware linked to the widespread destruction and bank account plundering has become even nastier with the ability to evade popular sandboxes, says Seculert CTO Aviv Raff.

Raff says the Dyre malware ducks popular sandbox tools by detecting the number of cores in its use.

The known but effective and previously unused technique is enough to beat at least eight of the most widely used free and commercial software, Raff says.

"If the machine has only one core it immediately terminates," Raff said in a blog post.

"As many sandboxes are configured with only one processor with one core as a way to save resources, the check performed by Dyre is a good and effective way to avoid being analysed.

"On the other hand, most of the PCs in use today have more than one core." Dyre is linked to a variant Dyre Wolf that IBM said last month plundered some $1 million from bank accounts.

Raff informed the affected sandbox developers of the evasion technique. Dyre's Upatre downloader also sports new evasion techniques including a different user agent and grammatical fixes previously used to identify the malware.

Raff says the technique proves that sandboxing should not be used in isolation to stamp out malware.

It is the latest development in a long history of cat-and-mouse warfare between malware writers and white hat defenders.

Criminals need to contend with infiltrating victim machines while avoiding anti-virus and white hats who look for indicators that are hallmarks of a type of malware.

Defenders meanwhile face malware that uses increasingly complex evasion techniques that are specifically honed to beat sandboxes, virtual machines and other tools.

Source: Seculert.

Get a powerful Linux Dual-Core dedicated server for less than $2.67 a day!


Home | Proxy Sentinel™ | Firewall Sentinel™ | FAQ | News | Sitemap | Contact
Copyright © Internet Security.ca    Terms of use    Privacy agreement    Legal disclaimer