Malware Bulletin : Week#1 (1st March-8th March 2019)

Here are the top news of the week in malware landscape.

1.Malware hiding by Spectre technique.

Early on this week scientist have discovered way to hide malwares by leveraging year old vulnerability found in the almost all processors known as Spectre . The new method develop by the researchers AKA ExSpectre allow to create a secure application in first glance of AV but actually a binary can be configured by using separate “Trigger” application running on the system to generate the strings of commands that hide malicious commands in background. Using ExSpecter, researcher were able to decrypt data in memory, as well as using application to run reverse shell and execute commands remotely. There is no way to detect this malware by either a dynamic or static methodology.

2.High severity Mac OS flaw : Buggy Cow

Google researches have revealed the critical flaw in the mac OS named as buggy COW .The name was given on the reference to the origin of this flaw i.e.COW(Copy on write) this functionality allow different processes to access same data object in memory , once they need to modify the data object they make their own copy instead of modifying it in the memory.It is important to protect the copied memory from further modification by the processes . If the malware is already running on the Mac OS then by using above vulnerability it can modify the memory without alerting any AV or system level surveillance.

Source : https://nakedsecurity.sophos.com/2019/03/06/google-reveals-buggycow-macos-security-flaw/

3.Backdoor applications found on Github.

Security researches of DFIR found network of Github repositories that distributes the hacked version of legitimate program’s.This program’s were installing the backdoor on the users system. Admin of respective repository is immediately blocked from his all accounts. This was note by one of researcher when he observe some strange behavior of the program after installing. It was creating a powershell script in the start up menu which which was provided by the free hosting services of dynamic DNS. More that 300 pieces of such programs were found. After this Github developer updates services that check vulnerability in programs that hosted on the site, which were unable to detect malware.

4.Trojan Pirate Matryoshka distributed via pirate bay.

Kasperesky Lab traced distribution of the Matryoshka to the hacked software on the pirate bay. Attackers placed the weaponized software’s on the pirate bay which leads to drop a Trojan on the users system. Once downloaded infection begins with the installation of Matryoshka installer. While installing a fake pirate bay form pops up which steals the credential of user. Regardless of the victims action it install adware on system. this Trojan often disguise as game.

5.NSA Revers engineering tool made public : Ghidra

Lats but not least, there is good news for all security researchers and malware analyst that NSA has made its one reverse engineering tool known as Ghidra public. This software will be distributed under GNU public license as open source project.According to Robert Joyce , senior advisor of NSA has said

“ NSA has developed a software reverse engineering framework known as GHIDRA, which will be demonstrated for the first time at RSAC 2019. An interactive GUI capability enables reverse engineers to leverage an integrated set of features that run on a variety of platforms including Windows, Mac OS, and Linux and supports a variety of processor instruction sets. The GHISDRA platform includes all the features expected in high-end commercial tools, with new and expanded functionality NSA uniquely developed. and will be released for free public use at RSA.”

Source :https://itsfoss.com/nsa-ghidra-open-source/

You can download it from here.