One of our readers submitted a malware sample his machine got infected with recently. The sample was a worm written in Visual Basic, so it was an easy analysis.
The worm offered nothing new really – the only thing that surprised me was how destructive it is (today we normally see only sneaky malware that tries to stay on your system as long as possible). Except setting dozens of registry keys to disable certain executables from being run (such as Anti Virus programs, but simple programs as Notepad as well), it did something really nasty:
In other words, it tries to delete all the files under the Program Files directory. Besides this, it tries to delete two other files:
Set k = fso.GetFile("c:\windows\explorer.exe")
Due to Windows File Protection, this will fail, but we can see that the malware author decided to be very destructive (the worm replicates itself to all available shares and disks before this).
After playing with it I decided to see what's the AV coverage of this (simple) piece of malware … and the result was shocking. On VirusTotal, only 11 out of 32 AV detected it:
AntiVir 126.96.36.199 2008.04.03 VBS/Zapchast
As you can see, most major anti-virus programs missed this (very simple) piece of malware. We've sent the sample to them so hopefully they will start detecting it soon, but this is another example of why we must not ignore old(er) technologies that the bad guys still rely on.
BojanI will be teaching next: Web App Penetration Testing and Ethical Hacking - SANS Brussels September 2019
Apr 3rd 2008
1 decade ago