(Source: NBC Universal)
Printing appears to be an inadvertent side effect, not an intended end goal
Trojan.Milicenso, first discovered in 2010, has grown into a wondrous piece of malware with a set of defense mechanisms that reminds one of state-created malware like Stuxnet. However, this piece of malware is clearly the work of freeland black hats, which look to use the clever package to deliver popular malware payloads, like Adware.Eorezo, an adware targeting French-speaking users.
The malware's methodology of hiding itself starts with its update procedure. The program only sends encrypted requests to attack servers, obfuscating the stolen details it has logged. Returned files are also encrypted to preserve secrecy.
The malware DLL also uses heavy-duty 16-byte RC4 encryption to prevent its code from being reverse engineered. It also contains clever -- and rather unique -- code to detect whether it's on a virtual machine, known public malware sandbox, or black-boxing site such as ThreatExpert.
The trojan supresses itself when on blackboxes/VMs. [Image Source: Symantec]
These precautions might have helped the Trojan escape detection or analysis by security professionals, were it not for an inadvertent error, much like Stuxnet's, which caused the malware to inadvertently list its presence.
In Stuxnet's case the red flag was failed code to confine the virus geographically to Iranian IPs. In the Trojan.Milicenso's case it's an executable .spl (spool) file named [DRIVE_LETTER]\system32\Spool\PRINTERS\[RANDOM].spl, which leads the infected machine to inadvertently print pages of garbage -- a paper salesman's dream.
Despite the profit potential for the paper industry (at the expense of the trees, of course), it does not appear that outcome was intentional. The malware authors went to great lengths to hide their program, but the mystery auto-printing allowed Symantec Corp. (SYMC) researchers to identify and quantify this latest variant.
Symantec and other antivirus providers have updated their software to detect and remove some variants of this Trojan. However, new version with garbage padding to escape detection have been popping up, so we may be hearing more about this merry printing virus for a while now.
Sources: Symantec, SANS
"It's okay. The scenarios aren't that clear. But it's good looking. [Steve Jobs] does good design, and [the iPad] is absolutely a good example of that." -- Bill Gates on the Apple iPad
|
Most Popular ArticlesHigh School Student Creates Storage Device that Can Charge in 20 Seconds
May 20, 2013, 6:51 AM
Apples Tries to Use Decade-Old Patents to Ban Samsung Galaxy S IV
May 22, 2013, 3:00 PM
NASA Awards $125,000 Grant for 3D Printed Food on Long-Term Space Travels
May 21, 2013, 1:32 PM
Microsoft Announces Voice-Controlled "Xbox One"
May 21, 2013, 12:55 AM
Cure For Baldness Could Be on Store Shelves within Two Years
May 22, 2013, 8:29 AM
|
