TrickBot malware returns with some devious new tools

A new sample of TrickBot has been discovered which checks the screen resolution of victim's machines in order to see if the malware is running inside a virtual machine.

In order to protect themselves and their systems when analyzing malware, security researchers often do so in a virtual machine. As a result of this, malware often employs anti-VM techniques to detect whether or not it is running in a virtual machine.

The anti-VM techniques used by malware include looking for particular processes, windows services, machine names and checking network card MAC addresses or CPU features.

• Nasty Trickbot malware exploits people’s Coronavirus fears
• VPN accounts targeted by new malware
• Also check out the best virtual machine software

If malware detects that it is indeed running in a virtual machine, it will stop its operations to avoid giving researchers further clues into how it works and who deployed it in the first place.

Screen resolution

Maciej Kotowicz from the cybersecurity firm MalwareLab found a new sample of the TrickBot Trojan that checks an infected computer's screen resolution to determine if it's a virtual machine.

TrickBot originally started out as a banking trojan but the malware has evolved to perform other malicious behavior including spreading laterally through a network, stealing saved credentials in browsers, stealing cookies and more.

Kotowicz first made his discovery public in a Tweet in which he revealed that a new sample of TrickBot is checking infected machines to see if they have a resolution of 800x600 or 1024x768. If either of these resolutions is found, TrickBot will stop running.

The reason the malware is checking for these two resolutions in particular is due to how researchers configure the virtual machines they use to analyze malware. When setting up a virtual machine, most researchers will not install the VM guest software that would allow them to use higher resolutions. Without this software installed, a virtual machine will usually not allow any resolutions other than 800x600 and 1024x768.

While unfortunate for researchers studying malware, this new anti-VM check is actually quite clever and hopefully other malware developers don't follow suit and add this feature to their malicious software.

• Keep your devices protected with the best antivirus software

Via BleepingComputer

July 03, 2020 at 12:51AM
Anthony Spadafora