{"id":9841,"date":"2013-02-22T00:00:37","date_gmt":"2013-02-22T07:00:37","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=9841"},"modified":"2018-10-05T12:20:03","modified_gmt":"2018-10-05T18:20:03","slug":"diy-malware-cryptor-as-a-web-service-spotted-in-the-wild","status":"publish","type":"post","link":"https://www.webroot.com/blog/2013\/02\/22\/diy-malware-cryptor-as-a-web-service-spotted-in-the-wild\/","title":{"rendered":"DIY malware cryptor as a Web service spotted in the wild"},"content":{"rendered":"

Just how easy is it to generate an undetected piece of malware these days? Too easy to be true, largely thanks to the rise of managed crypting services, and the re-emergence of the DIY<\/strong><\/a> (do it yourself) trend within the entire cybercrime ecosystem.<\/p>\n

With hundreds of thousands of new malware variants processed by the industry on a daily basis, it’s\u00a0fairly\u00a0logical to conclude that over the years, the bad guys have\u00a0adapted<\/strong><\/a> to signature-based antivirus scanning<\/strong><\/a> protection mechanisms, and have achieved disturbing levels of automation and efficiency. How do they do that?<\/p>\n

Let’s find out by profiling a recently spotted Web-based DIY malware cryptor, emphasize on the future potential of such underground projects, as well as provide MD5s of malware samples known to have been generated using it.<\/p>\n

More details:<\/p>\n

<\/p>\n

Sample screenshot of the DIY malware cryptor as a Web service:<\/strong><\/p>\n

\"Malware_Crypting_as_a_Web_Service\"<\/a><\/p>\n

As you can seen in the attached screenshot, the DIY Web service allows full customization of the malicious output. Thankfully, the service fails to “innovate”, and it also lacks major differentiation factors like the ones found in popular DIY malware generating tools available on the underground market. In fact, a\u00a0malware as a Web service that I profiled in 2007<\/a><\/strong>\u00a0had a better emphasis on customization features compared to this service, publicly advertised in early 2013. What about the pricing? $7 per sample. And the service currently accepts Western Union, MoneyGram, WebMoney and Liberty Reserve.<\/p>\n

It’s worth emphasizing on the fact that, in 2013, despite the availability and constant development of desktop based DIY malware cryptors, cybercriminals tend to rely on managed services that not only accept bulk orders, but also, anonymously pre-scan these binaries against the most popular antivirus scanners, ensuring a decent degree of QA (Quality Assurance) in these campaigns. In fact, one of the most popular services often integrated in such underground market propositions currently supports API calls for automatic domain\/URL checking against public and vendor-specific blacklisting services, and even has a Tor network server address. Although the service isn’t vertically integrating just yet, it’s revenue stream from advertisements of managed and DIY malware crypting services are worth mentioning in the context of how cybercriminals tend to collaborate.<\/p>\n

Are we going to see more Web based DIY malware cryptors? Definitely, especially for use in targeted attacks. However, for the time being, the real competition within the cybercrime ecosystem is where the bulk order processing vendors are.<\/p>\n

Sample MD5s crypted using the service:<\/strong>
\nMD5: 6768385e25f522ea29c03b3f6480ada7<\/em>
\nMD5: b4c26e201b23ab86a6f8063c995008bc<\/em>
\nMD5: f01e450d49cb8ef414aaf571afe494be<\/em>
\nMD5: 0666e1408b558ea964321d27afcd6e0f<\/em>
\nMD5: b55c58a0c66b806e5287fed7ca91c51a<\/em>
\nMD5: d69fe7757e15489633e989c42e0cb983<\/em>
\nMD5: e5811b906afe071c6a99cdc1a4bdce56<\/em>
\nMD5: 322e936e650e572fec4e37574876fc26<\/em>
\nMD5: a637487f2c7bbea83e99f7d51ad7f090<\/em>
\nMD5: 934fcd5cc0b923838cfe5b0f097c29d4<\/em>
\nMD5: bb6f5218af165f2b89da8b8cec2fffa5<\/em>
\nMD5: 09a694fec119f8a7a568808c1f6d3c23<\/em>
\nMD5: 9df0fee51e99d8d01e17ef7d74489bfa<\/em>
\nMD5: 9fcfdfd681ad0e9fa60a10d7a4a921b4<\/em>
\nMD5: ffc5e63edd63c335de95ad65fd892940<\/em>
\nMD5: fd00984c86e9ad85106eb4d725724b13<\/em>
\nMD5: 045d588a0326ce5b57753d7a8b25eca3<\/em>
\nMD5: cd3a156717b1fe8e787f961e2e889a27<\/em>
\nMD5: 4e73ab5ef4bf38e59f42796df863fbda<\/em>
\nMD5: 1168e24f7fc93cd68dce27c321fe58e5<\/em>
\nMD5: 35a314aba8bbe2dc84d44b4d05719f97<\/em>
\nMD5: de32a97b5b2b776c23242fc0553aa721<\/em>
\nMD5: 940d3a844c63cd07ab124fc76cfb9967<\/em>
\nMD5: bbc8806137c07eeb8339f9686ef28343<\/em>
\nMD5: a1dd3c7b756f2b24299eb4b6553c78a6<\/em>
\nMD5: 0dcd22907b0af6bdea04a62fc33dac13<\/em>
\nMD5: bb4f497f808e541bd0d1dde499346b9f<\/em>
\nMD5: 6dd835e8f32a7e4c8d7a9d6075db487c<\/em>
\nMD5: 28142e39877a873084818432e36f6117<\/em>
\nMD5: b03bafd130ee0970abe464f40efe02b4<\/em>
\nMD5: 0ff4385d18cdf2cb42dc5e6bae9d9346<\/em>
\nMD5: bf58fcb43c31b9c1fd4cfb144f04b505<\/em><\/p>\n

Webroot SecureAnywhere<\/a><\/strong>\u00a0users are proactively protected from these threats.<\/p>\n

You can find more about Dancho Danchev at his\u00a0LinkedIn Profile<\/strong><\/a>. You can also\u00a0follow him on \u00a0Twitter<\/strong><\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Just how easy is it to generate an undetected piece of malware these days? Too easy to be true, largely thanks to the rise of managed crypting services, and the re-emergence of the DIY (do it yourself) trend within the entire cybercrime ecosystem. With hundreds of thousands of new malware variants processed by the industry […]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[13367,13363,13355,6103,13369,9471,5733,13357,13359,3477,13365,13353,5873,10703,3947,5025,5977,3471,4313,13361],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/9841"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=9841"}],"version-history":[{"count":2,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/9841\/revisions"}],"predecessor-version":[{"id":25621,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/9841\/revisions\/25621"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=9841"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=9841"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=9841"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=9841"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}