Researchers have discovered a new malware ‘Rombertik’ which destroys the system if it realizes that it is being analyzed.
"Security researchers
are constantly looking for ways to better detect and evade each other. As
researchers have become more adept and efficient at malware analysis, malware
authors have made an effort to build more evasive samples,” Ben Baker and Alex
Chiu from Cisco Systems' Talos Group wrote in a blog post.
“Better static, dynamic, and automated analysis tools have
made it more difficult for attackers to remain undetected. As a result,
attackers have been forced to find methods to evade these tools and complicate
both static and dynamic analysis,” the blog post added.
Similar to Dyre, Romberik, which has multiple layers of
obfuscation and anti-analysis functions, is a complex malware which can be hooked
into the user’s browser to read credentials and other sensitive information for ex-filtration.
However, Dyre targets banking information unlike Rombertik which
collects information from all websites in an indiscriminate manner.
Researchers said Romberik arrives on any computer through a
phishing campaign or through an email attachment. It tries to check to see if
it is running within a sandbox. After that, it decrypts itself
and launches on the user’s computer. Once this process gets completed, a second
copy of itself launches and is overwritten with the spying functionality.
Before Rombertik begins spying on the system, it does a
final check to see if it is running in the system’s memory.
It destroys the computer’s master boot record, leaving the
system inoperable. If it cannot destroy then it targets all files in the user’s
home folder, by encrypting each one with random RC4 keys. It contains plenty of dummy code, which include 75 images
and 8,000 functions which is to hide the malware’s functionality.
If the malware is not detected, it checks the browser
activities, reading credentials and private information, before sending its
findings back to the attacker’s server.
The researchers said that in order to prevent ones’ computer
from Rombertik, people have to follow security basics like up-to-date security
software, ignore attachments from unknown senders and solid security policies
for businesses will all help avoid the malware.