hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015In 2014 we saw an increase in.NET malware related toATM attacks.Such malware is installed on the machineand controlled through the keypad.SysbotSysbot is a .NET IRC bot malware family. Sysbot displays the following behavioral and functionalcharacteristics:• It drops itself as svchost.exe in the start menu, ensuring it executes at system start.• It connects to IRC servers and uses predefined usernames to signal its activity.• The worm ultimately gives unauthorized access to the infected computer and sends sensitiveinformation to a remote attacker including IP address, processor, OS, enumerated USBdevices, and logical drives information.• The bot has the ability to update itself, which essentially allows it to download and installarbitrary files from remote locations.• The worm is moderately string-obfuscated, which further complicates its analysis.• The worm has multiple vectors it can use for propagation, including via IRC, MSN messenger,P2P networks, FTP servers, Facebook, and YouTube accounts, as well as removable USBdrives.• When spreading through IRC channels it entices users through social engineering to downloadand execute content.• The worm can also use MSN Messenger to send files and copies of itself to various P2P clientdownload locations with enticing names.• In the case of spreading via FTP servers, it attempts to copy itself to ftp:///index.exe,possibly hoping to be mistakenly executed in an attempt to get the host’s index.ATM malware attacksIn 2014 we saw an increase in .NET malware related to ATM attacks. Such malware is installedon the ATM and controlled through the ATM keypad. The majority of ATM host environmentsrun a Windows OS and allow seamless execution of .NET applications. Because these systemsare rarely examined by anti-malware software, such malware may persist for long periods oftime without being detected. At the same time the reports of such malware from the wild arelow enough that they tend to remain under the general public’s radar. The most notable .NETmalware families in this category are Tyupkin and Padpin. The malware runs in place of ATMcontrolledprograms and intercepts coded keypad requests to dispense the cash to interestedactors.Attribution of .NET malware to the Syrian conflict2014 was a year of much political and civil unrest around the world, including civil unrest andongoing armed conflict in Syria. The conflict coincides with a notable spike in the developmentand propagation of malware attributed to the region, and .NET malware is a feature. Sampleswere spread through a number of compromised social media accounts associated with bothsides of the conflict. There are cases in which Facebook pages were used to distribute malware,and others where users were enticed into downloading and running executables linked frompolitical videos posted on YouTube. The samples were not heavily obfuscated and ranged fromRATs to Trojan droppers and downloaders. Some malware associated with Syrian malwarefamilies are not strictly defined and may be detected as Variant.Kazy, Injector, MSIL.UL, MSIL.Agent, or Ransomlock. These generic name detections suggest the wide reuse of malwarecomponents and sources, and a lack of heavy obfuscation and encryption techniques.Overall, we see an increasing number of .NET malware appearing on the scene. Actors areenticed by the promise of multi-platform execution, the availability of numerous third-partylibraries and tools, and ease of development, coupled with ever-increasing levels of antidebuggingand code obfuscation techniques.31