Saturday, May 24, 2025
HomeMalwareEarly Bird - A Malware Code Injection Technique to Evade the Detection...

Early Bird – A Malware Code Injection Technique to Evade the Detection by Anti-Malware

Published on

SIEM as a Service

Follow Us on Google News

Advanced Malware threats nowadays using powerful Code Injection Technique called  “Early Bird” that helps to evade the detection by Anti-Malware software.

Code injection technique allows malware inject the malicious code into a legitimate process and run before an entry point of the process in Main threat.

This New technique abuse the anti-malware product to evade the detection since the malicious injection process started earlier before an Anti-Malware start its scanning process.

- Advertisement - Google News

Since the Malicious code has been injected before the entry point of the legitimate process, anti Malware scan only perform the legitimated process hence obfuscates the malicious code execution.

Various new Malware is using this technique such as DorkBot to evade the detection and compromise the targeted computers.

How does “Early Bird” Code Injection Technique Works

Early Bird Code injection flaw starts with creating a suspended process (a new process that executes and continue within the running process) and this suspended process(svchost.exe) most likely to be legitimate windows process.

Once the suspended process(svchost.exe) will be created then malware allocate a memory and write malicious code to that process.

After the required memory allocation, it Writes the Malicious code into the allocated memory space its also called hollow process infection.

Later it Queues an asynchronous procedure call (APC) to execute the code on the main thread and resuming the thread for the execution and the start address pointed to the entry point of Malicious code.

According to Microsoft, When a user-mode APC is queued, the thread to which it is queued is not directed to call the APC function unless it is in an alertable state” so APC will be in an alertable state in order to execute the APC.

According to cyberbit Research, “the thread has not even started its execution since the process was created in a suspended state. How does the malware “know” that this thread will be alertable at some point? Does this method work exclusively on svchost.exe or will it always work when a process is created in a suspended state?”

In this case, Malware can able to abuse the other process as well and researchers analyse the process that reveals when resuming the main threat and it loads the malicious code in a very early stage of thread initialization, before many security products place their hooks – which allows the malware to perform its malicious actions without being detected.

Early Bird code injection video

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Zero-Trust Policy Bypass Enables Exploitation of Vulnerabilities and Manipulation of NHI Secrets

A new project has exposed a critical attack vector that exploits protocol vulnerabilities to...

Threat Actor Sells Burger King Backup System RCE Vulnerability for $4,000

A threat actor known as #LongNight has reportedly put up for sale remote code...

Chinese Nexus Hackers Exploit Ivanti Endpoint Manager Mobile Vulnerability

Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager...

Hackers Target macOS Users with Fake Ledger Apps to Deploy Malware

Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Hackers Target macOS Users with Fake Ledger Apps to Deploy Malware

Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular...

GenAI Assistant DIANNA Uncovers New Obfuscated Malware

Deep Instinct’s GenAI-powered assistant, DIANNA, has identified a sophisticated new malware strain dubbed BypassERWDirectSyscallShellcodeLoader. This...

New Formjacking Malware Targets E-Commerce Sites to Steal Credit Card Data

A disturbing new formjacking malware has emerged, specifically targeting WooCommerce-based e-commerce sites to steal...