Tuesday, May 6, 2025
HomeMalwareEarly Bird - A Malware Code Injection Technique to Evade the Detection...

Early Bird – A Malware Code Injection Technique to Evade the Detection by Anti-Malware

Published on

SIEM as a Service

Follow Us on Google News

Advanced Malware threats nowadays using powerful Code Injection Technique called  “Early Bird” that helps to evade the detection by Anti-Malware software.

Code injection technique allows malware inject the malicious code into a legitimate process and run before an entry point of the process in Main threat.

This New technique abuse the anti-malware product to evade the detection since the malicious injection process started earlier before an Anti-Malware start its scanning process.

- Advertisement - Google News

Since the Malicious code has been injected before the entry point of the legitimate process, anti Malware scan only perform the legitimated process hence obfuscates the malicious code execution.

Various new Malware is using this technique such as DorkBot to evade the detection and compromise the targeted computers.

How does “Early Bird” Code Injection Technique Works

Early Bird Code injection flaw starts with creating a suspended process (a new process that executes and continue within the running process) and this suspended process(svchost.exe) most likely to be legitimate windows process.

Once the suspended process(svchost.exe) will be created then malware allocate a memory and write malicious code to that process.

After the required memory allocation, it Writes the Malicious code into the allocated memory space its also called hollow process infection.

Later it Queues an asynchronous procedure call (APC) to execute the code on the main thread and resuming the thread for the execution and the start address pointed to the entry point of Malicious code.

According to Microsoft, When a user-mode APC is queued, the thread to which it is queued is not directed to call the APC function unless it is in an alertable state” so APC will be in an alertable state in order to execute the APC.

According to cyberbit Research, “the thread has not even started its execution since the process was created in a suspended state. How does the malware “know” that this thread will be alertable at some point? Does this method work exclusively on svchost.exe or will it always work when a process is created in a suspended state?”

In this case, Malware can able to abuse the other process as well and researchers analyse the process that reveals when resuming the main threat and it loads the malicious code in a very early stage of thread initialization, before many security products place their hooks – which allows the malware to perform its malicious actions without being detected.

Early Bird code injection video

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX

As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search...

UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion

UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider,...

Over 2,800 Hacked Websites Targeting MacOS Users with AMOS Stealer Malware

Cybersecurity researcher has uncovered a massive malware campaign targeting MacOS users through approximately 2,800...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Over 2,800 Hacked Websites Targeting MacOS Users with AMOS Stealer Malware

Cybersecurity researcher has uncovered a massive malware campaign targeting MacOS users through approximately 2,800...

Hackers Target HR Departments With Fake Resumes to Spread More_eggs Malware

The financially motivated threat group Venom Spider, also tracked as TA4557, has shifted its...