Categories: Breaking NewsMalwareSecurity

Malware “TreasureHunter” innovates by using windows products IDs for its dynamic mutex

A new approach based on windows products IDs for dynamic mutex could allow the creation of new malware running undetected on systems for much more time.

Before talking about “TreasureHunter” itself, I think it’s worth to give you a background about mutex and as Microsoft says:

“For example, to prevent two threads from writing to shared memory at the same time, each thread waits for ownership of a mutex object before executing the code that accesses the memory. After writing to the shared memory, the thread releases the mutex object.”

For a malicious program, this means that we can check for names of mutex objects if we had already examined an infected system.

As Lenny Zeltser , the original author of the original article said:

” Malware authors who wish to employ mutex objects need a predictable way of naming those objects, so that multiple instances of malicious code running on the infected host can refer to the same mutex,”

Zeltser also stated:

“A typical way to accomplish this has been to hardcode the name of the mutex. The author of TreasureHunter decided to use a more sophisticated approach of deriving the name of the mutex based on the system’s Product ID.

“This helped the specimen evade detection in situations where incident responders or anti-malware tools attempted to use a static object name as the indicator of compromise.”

What was incredible in my point of view is that if you run “TreasureHunter” in different systems you get different mutex objects, making it virtually impossible to detect.

One proof for this is the submitted samples in “Virustotal” and “VxStream Sandbox” where you get a different mutex name.

Virustotal:

C:\DocumentsandSettings\<USER>\ApplicationData\3ed1ed60c7d7374bf0dd76fc664b39cd\jucheck.exe

VxStream Sandbox:

C:\Users\PSPUBWS\AppData\Roaming\3ac22cadc45e0558cad697d777f6c3d3\jucheck.exe

This new approach used by the malware developed of “Treasure Hunter”, opens the door to new ways of having malware running undetected on systems for much more time.

It will be interesting to see if there will be an evolution of this method.

About the Author Elsio Pinto

Elsio Pinto is at the moment the Lead Mcafee Security Engineer at Swiss Re, but he also as known in the areas of malware research, forensics, ethical hacking. He had previous experiences in major institutions being the European Parliament one of them. He is a security enthusiast and tries his best to pass his knowledge. He also owns his own bloghttp://high54security.blogspot.com/

[adrotate banner=”9″]

[adrotate banner=”12″]

Published by Pierluigi Paganini

(Security Affairs – malware, mutex object)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.