TrickBot phishing checks screen resolution to evade researchers
The TrickBot malware operators have been using a new method to check the screen resolution of a victim system to evade detection of security software and analysis by researchers. Last year, the TrickBot gang added a new feature to their malware that terminated the infection chain if a device was using non-standard screen resolutions of 800×600 and 1024×768.
Security researchers recently found a HTML attachment from a TrickBot malspam campaign that behaved differently on a real machine than on a virtual one. In this new variation a verification code has been added to the HTML attachment of the malspam delivered to the potential victim. While this appears to be an innovation from TrickBot operators, the trick is not new. A similar tactic has been increasing observed in phish kits to avoid identification and analysis by researchers.
Researchers have found phish kits with a script that determines if the user landing on the phishing page uses a virtual machine or a physical one by checking if the web browser uses a software renderer like as SwiftShader, LLVMpipe, or VirtualBox, which typically means that a virtual environment. The script also checks if the colour depth of the visitor’s screen is less than 24-bits, or if the screen height and width are less than 100 pixels.
Security researcher MalwareHunterTeam found in March this year a phishing kit that included code for checking the system’s screen resolution. Since then, the researcher told BleepingComputer that he saw the tactic being used multiple times in various phishing campaigns as a means to avoid investigators.
TrickBot is not using the same script as the one above but relies on the same tactic to detect a researcher’s sandbox. However, it’s a premiere for the gang to use such a script in an HTML attachment.
This may also be the first time malware uses an attachment to run a screen resolution check rather than doing it on the landing page serving the malware executable.
This highlights how malware operators are constantly looking to develop their tools to avoid detection.
With thanks to the Cyber Defence Alliance and Bleeping Computer. The full story is here: https://www.bleepingcomputer.com/news/security/trickbot-phishing-checks-screen-resolution-to-evade-researchers/
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW