Rombertik: A new malware designed to steal the credentials of its victims also develops very destructive behaviors on the computer it attacks in order to evade analysis tools that are usually included in antivirus programs.
Although the malware does not damage the computer during its installation, it inserts itself into almost all known browsers (Internet Explorer, Chrome and Firefox), and records the victim's every move from every website they visit.
The data it collects before being encrypted by the Web browser is delivered to the command and control (C&C) server via HTTP.
Malware analysts at Talos Group from Cisco Systems, who isolated a sample of the malware, dubbed Rombertik, attempted to reconstruct it to identify all the functions it contains so that it can bypass both static and dynamic analysis.
One of the final checks that Rombertik performs to ensure it evades detection is to create a hash in system memory that it compares with its uncompressed version.
If it detects any difference in compilation times, it unleashes destructive behavior, first destroying the computer's master boot record (MBR). It then begins encrypting the user's files.
The MBR is a boot sector that exists at the beginning of a hard disk, and is responsible for maintaining the information of all the partitions present on the computer as well as the data they contain.
So after Rombertik corrupts the MBR, the computer starts to reboot continuously and displays error messages.
Researchers report that bytes containing information about disk partitions are replaced with zero bytes, which makes data recovery a very difficult process.
The encryption process, which follows after the MBR is destroyed, completes the destruction of the computer, since each file is individually locked with a randomly generated RC4 key.
Analysis of the malware revealed that its creators tried to avoid using old code that often contains junk. They also report that over 97% of the code is free of malicious traces.
Also interesting is the technique used by Rombertik before decompression to fool the sandboxing tools found in antivirus products. The malware delayed its execution by writing a random byte to the system's memory 960 million times.
The consequence of this behavior is to bypass the sandbox timeout. However, this action also floods antivirus detection tools since to record the activity they would have to create a 100GB log file and would take more than 25 minutes to write it to disk.
Source: secnews.gr/
