SANS ISC: Is "2 out of 3" good enough for Anti-Malware?

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

One of my morning rituals is to take the last few malware samples I received in any of my inboxes and run them in a virtual machine to see if there is anything new. To be honest: There isn't much new that we haven't already written about. The sample is usually a zipped VBScript file that will download and run ransomware. But that isn't the only constant. The other constant is the inability of anti-malware to protect your system from these consistent attacks.

The virtual machine runs a fully patched Windows 10 install, and home-user grade anti-malware. I would consider it a "well configured" average home user system.

This morning, for example, I tried these three samples:

924936fb9f562dc08556bf0677a5d15c813eebde  SCAN_20160915_241418570.zip
c29dd0d1fe36b3891d685171683635c442d84c8d  SCAN_20160915_3640961765775.zip
6213e371567b4620064933efa43e5ffdba455c65  SCAN_20160915_894622558880029.zip

They all arrived in similar emails with a subject of "SCAN" . 

If you are paying attention of malware, you probably have seen e-mails like this for years with various attachments.

Two of these samples were nicely detected by my anti-malware solution, and I wasn't even able to copy them to my virtual machine. But the third one, which isn't substantially different, made it past whatever signature was used to detect these generic JavaScript downloaders.

Virustotal shows that some name-brand anti-malware solutions do not detect this particular sample:

https://www.virustotal.com/en/file/8acb71453b9759a64eea060949ad87bae3d6f070b04daf2f70ed124b1a905399/analysis/
https://www.virustotal.com/en/file/f732887b200563bfdd89f516fc30139ea21e8adbd3280df3436c289bc154383a/analysis/
https://www.virustotal.com/en/file/a9b4a38e515ee10e1dc8eda13ac9abd8c11c0eece4ac1cb1c746015d17ff5a0c/analysis/

It also shows that all of these samples were rather "fresh" in that Virustotal had received them about 30 minutes ago, so around the time I had received them.

Even if your anti-malware solution doesn't detect the downloader, there is still a chance that it will detect the malware that is downloaded by the JavaScript. This often leads to a false sense of security in that you will see, often multiple times, popups that your anti-malware solution did remove malicious code from your system. But these downloaders can be rather persistent. One sample I looked at yesterday took about 15 minutes, and about a dozen of "malware found" popups, until it finally downloaded a version of Locky that was not detected, and I ended up with another encrypted system.

So what can you do?

• The less malware reaches the user, the better. Filter as much on mail servers and proxies as you can using generic filters ("zipped VBscripts" and the list. We talked about this before).
• Once you notice a possible infection, NEVER trust anti-malware to clean your system. It is probably best to shut down the system as soon as you notice "malware found" popups. This way, you MAY prevent the final successful install, and you may be able to save some of your files from being encrypted.
• Just like you should not rely on anti-malware: Blocklists of bad URLs and the like are just as bad (ours included). They will help you in hindsight to figure out who got infected yesterday (or an hour ago if they are good), but they will not consistently prevent exploitation.

For example, here are the URLs that I think where used in the undetected sample (I didn't do a full analysis):

(spaces added to protect readers.)

bigfishcasting .com/ afdIJGY8766gyu?YJRTHAigKa=sLUfGQkQRhO
delicefilm .com /afdIJGY8766gyu?YJRTHAigKa=sLUfGQkQRhO (this one has some reasonable recognition as a bad URL)
keratin .sk/ afdIJGY8766gyu?YJRTHAigKa=sLUfGQkQRhO

The issue with anti-malware missing the downloader, and then hoping that the downloaded malware will be detected, isn't new, and going back at least to the famous "WMF" incident more than 10 years ago, when anti-virus was suggested as a mitigation for the vulnerability, even though it didn't detect actual exploitation of the vulnerability but instead only the additional malware downloaded via the exploit. 10+ years later... not much changed.  We are still making it too easy for the bad guys.

---
Johannes B. Ullrich, Ph.D.
STI|Twitter|LinkedIn