Click here to close now.

Welcome!

Security Authors: Adrian Bridgwater, Pat Romanski, Liz McMillan, Elizabeth White, Jacob Olcott

Related Topics: Security

Security: Blog Post

Malware Delivery – Understanding Multiple Stage Malware

How trusted file attachments has opened the vector for continued intrusions.

To some of us, seeing an email with malware embedded in a PDF, Word or Excel attachment is common. In fact, it has become the new norm for malware delivery to use file types that are not obviously malicious (versus something like a .exe). Gone are the days of wide-open acceptance of all file extensions for attachments within an email. In today's network defense-in-depth techniques, one of the layers is naturally email security. This includes the scrutinizing of emails for embedded links or attachments that could be potentially malicious, scanning attachments for possible detectable viruses and even inspecting the mail header for details that could point to the continued use of a particular "sender" address targeting an organization.

With the delivery of the malware always evolving to avoid being detected, why is it so common to see multi-stage malware? What exactly IS multi-stage malware, and why can it be more difficult to detect through common defense-in-depth strategies? I recently sat with a customer who ran these questions by me.  They were concerned that this might be some kind of new and sophisticated attack being used against their organization that their security team was not aware of. Truth is, this type of attack method is more common than you know, and has been going on for a significant period of time.

Let's start by tackling the easiest questions.

Question: What is multi-stage malware?

Answer: It is malware that is delivered in stages.  Seriously, that's it.

Question: So then what are the stages?

Answer: Ah, I was hoping that was your next question...

The typical stages for the delivery are as follows;

Stage 1: The main goal of the first stage is to simply get some kind of execution on a victim computer to retrieve the larger portion of the malware.  Utilizing a legitimate looking file (PDF, DOC, XLS) that is embedded with the stage 1 malware, the attacker can entice the target to open it, and allow execution. After execution, the first stage malware may also find some way to make itself persistent. What do I mean by persistent? Well let's say that as soon as you open an infected PDF, the stage 1 malware begins execution on your computer, but you happen to immediately shut down your computer.  If that malware did not create some kind of way to re-execute after you start your computer, it will not execute again until you open the infected PDF again. Attackers know that it's unlikely you will re-open the attachment, so they like to build in a way for the malware to re-execute after your computer starts up.  That way it is guaranteed to finish its initial job, which is to retrieve the next stage malware.

Stage2: This is where the more robust malware sections of the malware are introduced, potentially causing an unfettered amount of damage to its victim computer. Stage 2 typically gives the attacker an array of capabilities that are not available with stage 1, such as:

  • Victim computer screen capture
  • Start webcam
  • Graphical ability to browse victim computer file system
  • Stealing of files and software
  • Deletion of files
  • Elevation or escalation of privileges
  • Keylogging and potential destruction of the victim file system

Furthermore, Stage 2 malware may also provide the ability for the attacker to migrate to another computer on the same network which provides the ability for even more extensive damage by allowing the attacker to spread out and cause an increase in damage.

Question: Are those the only stages of delivery?

Answer: Not always, but this is the most common.  Sometimes "plugins" or "modules" are available to add to the malware, and they can be delivered or removed on an as needed basis.  The attacker wants to limit the amount of network traffic to a particular domain that is hosting malware as this could lead to detection and blocking, which would stop the potential for successful delivery of any future malware or even stage 2.

Question: Why stage the delivery at all?  Why not just embed all of the malware instead of a portion in the infected document or file?

Answer: There are a few reasons for staging the delivery, one of them being size. Simply put, if the size of the malware is large enough then embedding the whole thing into a PDF would make the file quite large; therefore, more suspicious.  Another reason is to limit the possibility of detection through various scanners and traffic inspectors. The first stage of the malware is quite light in what commands and system calls that it makes which helps to evade detection by signature or even heuristics. It is not uncommon at all to see a PDF reader software open a PDF, then immediately connect to the Internet. Most PDF readers routinely check for updates as soon as they are opened, and attackers know this to be true often enough.  So the stage 1 malware just hides within that behavior, reducing its ability to be detected. Lastly, development of custom malware is expensive and takes time, so losing the entire piece of malware due to detection of any sort can be a huge set back to the attackers. Even if the attackers are using commercial or open source attack tools, rebuilding them to avoid antivirus detection can be time consuming and costly. Losing the stage 1 malware through  detection is easier to address than burning the complete malware package. By staging the delivery it limits the potential loss to the attacker. There many other reasons to break the malware up and retrieve upon infection, but these are some of the most important ones.

Question: This is making more and more sense to me, but just quickly can you go over why it's much harder to detect?

Answer: The smaller and more embedded the malware is, the more difficult to detect, especially inside of a commonly used and trusted file. When the commands for the malware are simplified as well as the needs from a victim computer to execute, again, detection is difficult. When malware is overly complicated, or it has large consumption requirements from the operating system to correctly function, the chances for detection though defense-in-depth techniques is increased. Large, complicated malware is more likely to break and alert the user to its presence, or even get detected by antivirus. It is also most likely to fail Deep Packet Inspection at the IDS/IPS layer due to possible signatures for specific system calls the malware makes. Small, simple malware finds a home inside of the most common files and documents that we not only use and open every day, but also are typically allowable as an attachment in an email. Because the malware is small, it can be easily modified, making signature development almost impossible. Breaking the malware apart also changes which security tools are inspecting the malware. If stage 1 is delivered through an email, than you will have to get through an IDS/IPS, an Email AntiVirus product (if you are dealing with an enterprise), as well as any attachment inspection that occurs on the email gateway. Stage 2 is then delivered after successful infection of victim computer, typically after the victim computer asks a particular web server for the stage 2 malware. If this request is done over SSL/HTTPS, then there is a good chance there will be no inspection of the malware until it reaches the host.  At delivery, the malware has to contend with antivirus on the victim computer, which is trivial for a sophisticated attacker to either bypass or defeat.

Question: If it's so damn hard to detect, how on earth do I stop it?

Answer: Excellent question, this is something we can address in my next blog, "Better Host Based Protection, Logically".

More Stories By Cory Marchand

Cory Marchand is a trusted subject matter expert on topics of Cyber Security Threats, Network and Host based Assessment and Computer Forensics. Mr. Marchand has supported several customers over his 10+ years within the field of Computer Security including State, Federal and Military Government as well as the Private sector. Mr. Marchand holds several industry related certificates including CISSP, EnCE, GSEC, GCIA, GCIH, GREM, GSNA and CEH.

@ThingsExpo Stories
Dave will share his insights on how Internet of Things for Enterprises are transforming and making more productive and efficient operations and maintenance (O&M) procedures in the cleantech industry and beyond. Speaker Bio: Dave Landa is chief operating officer of Cybozu Corp (kintone US). Based in the San Francisco Bay Area, Dave has been on the forefront of the Cloud revolution driving strategic business development on the executive teams of multiple leading Software as a Services (SaaS) application providers dating back to 2004. Cybozu's kintone.com is a leading global BYOA (Build Your O...
Health care systems across the globe are under enormous strain, as facilities reach capacity and costs continue to rise. M2M and the Internet of Things have the potential to transform the industry through connected health solutions that can make care more efficient while reducing costs. In fact, Vodafone's annual M2M Barometer Report forecasts M2M applications rising to 57 percent in health care and life sciences by 2016. Lively is one of Vodafone's health care partners, whose solutions enable older adults to live independent lives while staying connected to loved ones. M2M will continue to gr...
SYS-CON Events announced today that Vicom Computer Services, Inc., a provider of technology and service solutions, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. They are located at booth #427. Vicom Computer Services, Inc. is a progressive leader in the technology industry for over 30 years. Headquartered in the NY Metropolitan area. Vicom provides products and services based on today’s requirements around Unified Networks, Cloud Computing strategies, Virtualization around Software defined Data Ce...
What exactly is a cognitive application? In her session at 16th Cloud Expo, Ashley Hathaway, Product Manager at IBM Watson, will look at the services being offered by the IBM Watson Developer Cloud and what that means for developers and Big Data. She'll explore how IBM Watson and its partnerships will continue to grow and help define what it means to be a cognitive service, as well as take a look at the offerings on Bluemix. She will also check out how Watson and the Alchemy API team up to offer disruptive APIs to developers.
The IoT Bootcamp is coming to Cloud Expo | @ThingsExpo on June 9-10 at the Javits Center in New York. Instructor. Registration is now available at http://iotbootcamp.sys-con.com/ Instructor Janakiram MSV previously taught the famously successful Multi-Cloud Bootcamp at Cloud Expo | @ThingsExpo in November in Santa Clara. Now he is expanding the focus to Janakiram is the founder and CTO of Get Cloud Ready Consulting, a niche Cloud Migration and Cloud Operations firm that recently got acquired by Aditi Technologies. He is a Microsoft Regional Director for Hyderabad, India, and one of the f...
The 17th International Cloud Expo has announced that its Call for Papers is open. 17th International Cloud Expo, to be held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, brings together Cloud Computing, APM, APIs, Microservices, Security, Big Data, Internet of Things, DevOps and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit your speaking proposal today!
SYS-CON Events announced today that SoftLayer, an IBM company, has been named “Gold Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place June 9-11, 2015 at the Javits Center in New York City, NY, and the 17th International Cloud Expo®, which will take place November 3–5, 2015 at the Santa Clara Convention Center in Santa Clara, CA. SoftLayer operates a global cloud infrastructure platform built for Internet scale. With a global footprint of data centers and network points of presence, SoftLayer provides infrastructure as a service to leading-edge customers ranging from ...
SYS-CON Events announced today that Cisco, the worldwide leader in IT that transforms how people connect, communicate and collaborate, has been named “Gold Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Cisco makes amazing things happen by connecting the unconnected. Cisco has shaped the future of the Internet by becoming the worldwide leader in transforming how people connect, communicate and collaborate. Cisco and our partners are building the platform for the Internet of Everything by connecting the...
SYS-CON Events announced today that Liaison Technologies, a leading provider of data management and integration cloud services and solutions, has been named "Silver Sponsor" of SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York, NY. Liaison Technologies is a recognized market leader in providing cloud-enabled data integration and data management solutions to break down complex information barriers, enabling enterprises to make smarter decisions, faster.
SYS-CON Events announced today that Windstream, a leading provider of advanced network and cloud communications, has been named “Silver Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9–11, 2015, at the Javits Center in New York, NY. Windstream (Nasdaq: WIN), a FORTUNE 500 and S&P 500 company, is a leading provider of advanced network communications, including cloud computing and managed services, to businesses nationwide. The company also offers broadband, phone and digital TV services to consumers primarily in rural areas.
SYS-CON Events announced today that Ciqada will exhibit at SYS-CON's @ThingsExpo, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Ciqada™ makes it easy to connect your products to the Internet. By integrating key components - hardware, servers, dashboards, and mobile apps - into an easy-to-use, configurable system, your products can quickly and securely join the internet of things. With remote monitoring, control, and alert messaging capability, you will meet your customers' needs of tomorrow - today! Ciqada. Let your products take flight. For more inform...
SYS-CON Events announced today that ProfitBricks, the provider of painless cloud infrastructure, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY., and the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. ProfitBricks is the IaaS provider that offers a painless cloud experience for all IT users, with no learning curve. ProfitBricks boasts flexible cloud servers and networking, an integrated Data Center Designer tool f...
SYS-CON Events announced today that GENBAND, a leading developer of real time communications software solutions, has been named “Silver Sponsor” of SYS-CON's WebRTC Summit, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. The GENBAND team will be on hand to demonstrate their newest product, Kandy. Kandy is a communications Platform-as-a-Service (PaaS) that enables companies to seamlessly integrate more human communications into their Web and mobile applications - creating more engaging experiences for their customers and boosting collaboration and productiv...
SYS-CON Events announced today that Dyn, the worldwide leader in Internet Performance, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Dyn is a cloud-based Internet Performance company. Dyn helps companies monitor, control, and optimize online infrastructure for an exceptional end-user experience. Through a world-class network and unrivaled, objective intelligence into Internet conditions, Dyn ensures traffic gets delivered faster, safer, and more reliably than ever.
SYS-CON Events announced today that Open Data Centers (ODC), a carrier-neutral colocation provider, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place June 9-11, 2015, at the Javits Center in New York City, NY. Open Data Centers is a carrier-neutral data center operator in New Jersey and New York City offering alternative connectivity options for carriers, service providers and enterprise customers.
SYS-CON Events announced today that BroadSoft, the leading global provider of Unified Communications and Collaboration (UCC) services to operators worldwide, has been named “Gold Sponsor” of SYS-CON's WebRTC Summit, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. BroadSoft is the leading provider of software and services that enable mobile, fixed-line and cable service providers to offer Unified Communications over their Internet Protocol networks. The Company’s core communications platform enables the delivery of a range of enterprise and consumer calling...
SYS-CON Events announced today that On the Avenue Marketing Group, a sales and marketing firm that utilizes events to market and sell products to consumers, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. On the Avenue Marketing Group (OTA) is a sales and marketing firm that utilizes events to market and sell products to consumers. On behalf of our clients, we attend thousands of fairs, festivals, expos, concerts, conferences, and sporting events annually, helping them reach millions of individuals ...
SYS-CON Events announced today that ActiveState, the leading independent Cloud Foundry and Docker-based PaaS provider, has been named “Silver Sponsor” of SYS-CON's DevOps Summit New York, which will take place June 9-11, 2015, at the Javits Center in New York City, NY. ActiveState believes that enterprises gain a competitive advantage when they are able to quickly create, deploy and efficiently manage software solutions that immediately create business value, but they face many challenges that prevent them from doing so. The Company is uniquely positioned to help address these challenges thro...
SYS-CON Events announced today that Vitria Technology, Inc. will exhibit at SYS-CON’s @ThingsExpo, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Vitria will showcase the company’s new IoT Analytics Platform through live demonstrations at booth #330. Vitria’s IoT Analytics Platform, fully integrated and powered by an operational intelligence engine, enables customers to rapidly build and operationalize advanced analytics to deliver timely business outcomes for use cases across the industrial, enterprise, and consumer segments.
SYS-CON Events announced today that Alert Logic, the leading provider of Security-as-a-Service solutions for the cloud, has been named “Bronze Sponsor” of SYS-CON's 16th International Cloud Expo® and DevOps Summit 2015 New York, which will take place June 9-11, 2015, at the Javits Center in New York City, NY, and the 17th International Cloud Expo® and DevOps Summit 2015 Silicon Valley, which will take place November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA.