Monday, November 4, 2024
HomeInfosec- ResourcesHackers Increasing the use of "Command Line Evasion and Obfuscation" to...

Hackers Increasing the use of “Command Line Evasion and Obfuscation” to Spread Advance Level Threats

Published on

Malware protection

Advance level threats are increasing day by day and attackers using more Sophisticated Techniques to bypass the Detection. Evasion and obfuscation technique give more pain to Researchers in 2017 Compare to previous years.

Command line evasion and obfuscation are the most used technique among many numbers of advance level attacks which are increased its use by attackers with their phishing and Malware attacks.

Malicious hackers use Fileless malware to achieve stealth, privilege escalation, to gather sensitive information and achieve persistence in the system, so the malware infection can continue to carry on its effect for a longer period of time.

- Advertisement - SIEM as a Service

More over sometime VB Script code aslo has highly obfuscated and it developed to evade the sandbox Detection and its make Difficult to understand

It used to create with Advanced level obfuscation to bypass both static and dynamic analysis method and attacker always on step ahead from  signature-based detection methods.

Also Read  Creating and Analyzing a Malicious PDF File with PDF-Parser Tool

Environment Variable Attack by Advance Level Threats

An earlier time of 2017 ,FIN8 malware received command using standard input to evade detection based on process command line arguments by using environment variables paired with Power Shell.

Powers hell command that ends with Dash “-“ ,that will Execute the command by using standard input (Stdin) and the only dash will appear in powershell.exe’s command line arguments.

FIN8 environment variable commands extracted (Source: FireEye)

According to FireEye , In the February 2017 phishing document “COMPLAINT Homer Glynn.doc” (MD5: cc89ddac1afe69069eb18bac58c6a9e4tt), the file contains a macro that sets the PowerShell command in one environment variable(_MICROSOFT_UPDATE_CATALOG) and then the string “powershell -” in another environment variable (MICROSOFT_UPDATE_SERVICE).

Evasion and obfuscation detection’s based parent-child process relationships. FIN8 crafted this macro to use WMI to spawn the “cmd.exe” execution.

Therefore, WinWord.exe never creates a child process, but the process tree looks like: wmiprvse.exe > cmd.exe > powershell.exe. 

Also Read  Most important considerations with Malware Analysis Cheats And Tools list

Application whitelisting Bypass

To stay away from many Detection techniques and Defenders, Attackers using extra layers of obfuscation by new application whitelisting bypass techniques.

According to FireEye , The regsvr32.exe  application whitelisting bypass exploit done by few Groups

  1. APT19 in their 2017 campaign against law firms
  2. The cyber espionage group APT32 heavily obfuscates their backdoors and scripts
  3. Mandiant consultants observed APT32 implement additional command argument obfuscation in April 2017
Regsvr32 is a command-line utility to register and unregister OLE controls, such as DLLs and ActiveX controls in the Windows Registry. Regsvr32.exe is installed in the %systemroot%\System32 folder in Windows XP and later versions of Windows.

APT32 used cmd.exe obfuscation techniques to attempt to break signature-based detection of this argument ,Instead of using the argument /i:https for the regsvr32.exe bypass.

FireEye Identified New obfuscation Technique in both JavaScript and cmd.exe levels and perform the initial infection, it hiding shortcut files (LNK files) in their DOCX and RTF phishing documents. Read more here for complete Analyse.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals...

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215...

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors...

Russia, Iran, And China Influence U.S. Elections, Microsoft Warns

The researchers have observed consistent efforts by Russia, Iran, and China to exert foreign...

Threat Actor ProKYC Selling Tools To Bypass Two-Factor Authentication

Threat actors are leveraging a newly discovered deepfake tool, ProKYC, to bypass two-factor authentication...