Financial Malware Detects Remote Desktop Environments To Evade Researchers

Like any other group of business people, cybercriminals want to protect their investments.

In the case of malware, that means thwarting research and analysis. According to Trusteer, the author of the financial malware platform known as Shylock has added a new mechanism to identify and avoid remote desktop environments commonly used by researchers when analyzing malware.

"Suspected malware samples are collected for analysis and often placed onto machines that are isolated in an operations center ("lab")," explains Gal Frishman, malware research team leader at Trusteer, in a blog post. "Rather than sitting in front of a rack of physical machines in a cold basement lab, researchers use remote desktop connections to study malware from the convenience and coziness of their offices.

"It is this human weakness that Shylock exploits," Frishman continues. "We have discovered advanced malware that is now capable of detecting remote desktop environments to evade researchers."

The Shylock dropper does this by feeding invalid data into a particular routine and then watching the error code that gets returned. It uses this return code to differentiate between normal desktops and lab environments, the researcher explains. When executed from a remote desktop session, the return code will be different and the malware will not install.

"The dropper dynamically loads Winscard.dll and calls the functionSCardForgetReaderGroupA(0, 0)," writes Fishman. "The malware proceeds as expected only if the return value is either 0x80100011 (SCARD_E_INVALID_VALUE) or 0x2 (ERROR_FILE_NOT_FOUND). We noticed that when the dropper is executed locally the return value is 0x80100011, but when it is executed from a remote desktop session the return value is 0x80100004 (SCARD_E_INVALID_PARAMETER)."

Malware authors are continuously developing techniques to evade sandboxes used for analysis, notes Vikram Thakur, principal manger at Symantec Security Response.

"There are many virtual environments that are detected by malware these days," he tells Dark Reading. "In fact, just recently we spotted two new techniques added to the list of techniques used by malware to evade sandboxes -- monitoring of mouse movement and monitoring for code to lay dormant for five minutes before execution.

"Avoiding remote desktop sessions can, indeed, work to accomplish the same purpose," he adds. "At the end of the day, malware authors realize that organizations use automated techniques in order to determine the capabilities of malware. By investing development time to circumvent sandboxes, they are trying to buy themselves some time before they get detected."

At the Black Hat security conference (PDF) this year, researchers presented techniques they said could make malware analysis unscalable by designing malware that fails to execute correctly on any environment other than the one originally affected.

In the coming year, those types of techniques will become more common, predicts Tomer Teller, security evangelist with Check Point Software Technologies.

"Malware will be more dedicated and will attack only computers with a specific configuration," he says. "The ability of malware to thwart analysis will improve in the new year."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.