{"id":6160,"date":"2017-12-27T16:32:51","date_gmt":"2017-12-27T16:32:51","guid":{"rendered":"https:\/\/www.n-able.com\/?p=6160"},"modified":"2021-04-09T16:51:15","modified_gmt":"2021-04-09T15:51:15","slug":"evasive-malware-enemy-you-cant-see","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see","title":{"rendered":"Evasive Malware: The Enemy You Can\u2019t See"},"content":{"rendered":"

Many managed service providers (MSPs) have a solid security offering to protect their customers from ransomware, external attacks, viruses, and malware. But there\u2019s a growing trend in the way malware works, where it utilizes specific actions to\u00a0avoid being detected<\/em>. It\u2019s dangerous stuff, as these evasive methods are being adopted by ransomware, APTs, and external attacks.<\/p>\n

So, what is Evasive Malware and how is it different?<\/p>\n

\"malware.jpg\"Let\u2019s start with a look at what a normal piece of malware does. In its most simplistic sense, malware starts with a\u00a0dropper<\/a>\u00a0that executes, connects to a\u00a0Command & Control server<\/a>, downloads the malware payload, and lastly, launches that payload.\u00a0 The \u201cproblem\u201d with this method (that is, a problem for the malware authors) is that MSPs\u2019 antivirus (AV) engines have advanced from being signature-based to using detection engines based on heuristics and behavior\u2014and now even include machine learning and AI. This means that most malware following the \u201cconventional\u201d pattern is going to be caught.<\/p>\n

Evasive Malware<\/em>\u00a0is different. Unlike regular malware that simply runs and hopes for the best, Evasive Malware is more like a ninja\u2014it hides in the shadows, constantly looking around to ensure it\u2019s not seen until the moment of attack (and, even then, the attack is usually so silent, no one notices it).<\/p>\n

Tactically speaking, Evasive Malware does a number things to avoid being caught; these include:<\/p>\n

It Checks Out the Environment<\/h2>\n

\"AvoidingEvasiveMalware.jpg\"Before it does anything, Evasive Malware checks to see if it\u2019s running in a virtual machine\u2014this could indicate that it is in\u00a0sandbox<\/a>, where it\u2019s behavior is being observed. It then goes on to look at whether AV or security tools are running (which are generally bad for malware), and for the presence of analysis tools (like Wireshark\u00ae<\/sup>\u00a0or Process Explorer). Should the Evasive Malware detect any of these prior to running,\u00a0it simply doesn\u2019t run<\/em>.\u00a0<\/i><\/p>\n

The thinking is to not have the Evasive Malware run in what it considers a\u00a0hostile environment,<\/em>\u00a0and instead, to wait for another time when the environment is more \u201cmalware-friendly.\u201d For example, if your customer has an\u00a0Email Gateway<\/a>\u00a0in place that scans email, Evasive Malware won\u2019t run in the gateway\u2019s sandbox, in the hope that once it gets to the user\u2019s Inbox, it will be relaunched and be able to run successfully.<\/p>\n

It Goes Directly to Memory<\/h2>\n

\"system.jpg\"Endpoint protection and next-gen AV solutions tend to focus on processes running. A new malware instance is a new process and is, therefore, subject to scrutiny. Instead, Evasive Malware uses OS-supported techniques to hollow out existing running processes and inject its own code into the memory location. The end result is your security solutions think it\u2019s NOTEPAD.EXE running, but it\u2019s actually malware.<\/p>\n

<\/h2>\n

It Leverages Document Files<\/h2>\n

The old-school method of infection was to attach a .exe file to an email. The new methodologies leverage document files (e.g., Word, Excel\u00ae<\/sup>, PDFs, etc.) that have some ability to execute. For example, I\u2019ve seen an instance of malware where the dropper is a PDF that downloads a Word doc from a compromised website, that then in turn uses macro code to pull down the malware payload to infect the machine.<\/p>\n

It sounds like a lot of work, but when you\u2019re trying to avoid being detected, these additional steps are necessary.<\/p>\n

It Stays One Step Ahead<\/h2>\n

Cybercriminal organizations are keenly aware of the value of your data and now function like software vendors\u2014just like the good guys\u2014and test their latest variants against current instances of security solutions in an attempt to stay one step ahead.<\/p>\n

Avoiding Evasive Malware<\/h2>\n

Your initial steps to combat Evasive Malware are to ensure AV and\/or endpoint protection is on all machines and is ALWAYS up-to-date. Taking things a step further, solutions do exist specifically to address Evasive Malware; these work by telling the malware it\u2019s always in a \u201chostile environment\u201d so that it never runs. In addition, given that ransomware variants are now adopting some of these techniques, having backups becomes all that much more important as a precaution.<\/p>\n

Nick Cavalancia has over 20 years of enterprise IT experience and is an accomplished executive, consultant, trainer, speaker, and columnist. He has authored, co-authored and contributed to over a dozen books on Windows\u00ae<\/sup><\/b>, Active Directory\u00ae<\/sup><\/b>, Exchange\u2122<\/sup>\u00a0and other Microsoft technologies. Nick has also held executive positions at ScriptLogic\u00ae<\/sup><\/b>, SpectorSoft\u00ae<\/sup><\/b>\u00a0and Netwrix\u00ae<\/sup><\/b>\u00a0and now focuses on the evangelism of technology solutions.<\/em><\/p>\n

Follow Nick on Twitter\u00ae<\/sup><\/b>\u00a0at\u00a0@nickcavalancia<\/a><\/em><\/p>\n

Click here<\/b><\/a>\u00a0to find out how SolarWinds\u00ae<\/sup>\u00a0Risk Intelligence can help you protect your business.<\/b><\/p>\n","protected":false},"excerpt":{"rendered":"

The rise of advanced AV engines has forced malware creators to take evasive action. Here\u2019s what you need to know about the new Evasive Malware.<\/p>\n","protected":false},"author":51,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-6160","post","type-post","status-publish","format-standard","hentry","topic-security"],"acf":[],"yoast_head":"\nEvasive Malware: The Enemy You Can\u2019t See - N-able<\/title>\n<meta name=\"description\" content=\"The rise of advanced AV engines has forced malware creators to take evasive action. Here\u2019s what you need to know about the new Evasive Malware.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see\" \/>\n<meta property=\"og:locale\" content=\"de_DE\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Evasive Malware: The Enemy You Can\u2019t See - N-able\" \/>\n<meta property=\"og:description\" content=\"The rise of advanced AV engines has forced malware creators to take evasive action. Here\u2019s what you need to know about the new Evasive Malware.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see\" \/>\n<meta property=\"og:site_name\" content=\"N-able\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/NableMSP\" \/>\n<meta property=\"article:published_time\" content=\"2017-12-27T16:32:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-04-09T15:51:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/12\/malware.jpg\" \/>\n<meta name=\"author\" content=\"Nick Cavalancia\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Nable\" \/>\n<meta name=\"twitter:site\" content=\"@Nable\" \/>\n<meta name=\"twitter:label1\" content=\"Verfasst von\" \/>\n\t<meta name=\"twitter:data1\" content=\"Nick Cavalancia\" \/>\n\t<meta name=\"twitter:label2\" content=\"Gesch\u00e4tzte Lesezeit\" \/>\n\t<meta name=\"twitter:data2\" content=\"4\u00a0Minuten\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see\"},\"author\":{\"name\":\"Nick Cavalancia\",\"@id\":\"https:\/\/www.n-able.com\/de#\/schema\/person\/4e0156a83ca71f429d1af500f8dac549\"},\"headline\":\"Evasive Malware: The Enemy You Can\u2019t See\",\"datePublished\":\"2017-12-27T16:32:51+00:00\",\"dateModified\":\"2021-04-09T15:51:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see\"},\"wordCount\":777,\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/de#organization\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/12\/malware.jpg\",\"articleSection\":[\"Security\"],\"inLanguage\":\"de\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see\",\"url\":\"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see\",\"name\":\"Evasive Malware: The Enemy You Can\u2019t See - N-able\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/de#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/12\/malware.jpg\",\"datePublished\":\"2017-12-27T16:32:51+00:00\",\"dateModified\":\"2021-04-09T15:51:15+00:00\",\"description\":\"The rise of advanced AV engines has forced malware creators to take evasive action. Here\u2019s what you need to know about the new Evasive Malware.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see#breadcrumb\"},\"inLanguage\":\"de\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see#primaryimage\",\"url\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/12\/malware.jpg\",\"contentUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/12\/malware.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Security\",\"item\":\"https:\/\/www.n-able.com\/de\/blog\/category\/security\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Evasive Malware: The Enemy You Can\u2019t See\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.n-able.com\/de#website\",\"url\":\"https:\/\/www.n-able.com\/de\",\"name\":\"N-able\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/de#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.n-able.com\/de?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"de\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.n-able.com\/de#organization\",\"name\":\"N-able\",\"url\":\"https:\/\/www.n-able.com\/de\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\/\/www.n-able.com\/de#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"contentUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"width\":\"1024\",\"height\":\"1024\",\"caption\":\"N-able\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/de#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/NableMSP\",\"https:\/\/x.com\/Nable\",\"https:\/\/www.linkedin.com\/company\/n-able\",\"https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.n-able.com\/de#\/schema\/person\/4e0156a83ca71f429d1af500f8dac549\",\"name\":\"Nick Cavalancia\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/4082bc26b8621c709a9d01d3269690e7760cce48ac67f8a46ea0a195818c1189?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4082bc26b8621c709a9d01d3269690e7760cce48ac67f8a46ea0a195818c1189?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4082bc26b8621c709a9d01d3269690e7760cce48ac67f8a46ea0a195818c1189?s=96&d=mm&r=g\",\"caption\":\"Nick Cavalancia\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Evasive Malware: The Enemy You Can\u2019t See - N-able","description":"The rise of advanced AV engines has forced malware creators to take evasive action. Here\u2019s what you need to know about the new Evasive Malware.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see","og_locale":"de_DE","og_type":"article","og_title":"Evasive Malware: The Enemy You Can\u2019t See - N-able","og_description":"The rise of advanced AV engines has forced malware creators to take evasive action. Here\u2019s what you need to know about the new Evasive Malware.","og_url":"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see","og_site_name":"N-able","article_publisher":"https:\/\/www.facebook.com\/NableMSP","article_published_time":"2017-12-27T16:32:51+00:00","article_modified_time":"2021-04-09T15:51:15+00:00","og_image":[{"url":"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/12\/malware.jpg","type":"","width":"","height":""}],"author":"Nick Cavalancia","twitter_card":"summary_large_image","twitter_creator":"@Nable","twitter_site":"@Nable","twitter_misc":{"Verfasst von":"Nick Cavalancia","Gesch\u00e4tzte Lesezeit":"4\u00a0Minuten"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see#article","isPartOf":{"@id":"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see"},"author":{"name":"Nick Cavalancia","@id":"https:\/\/www.n-able.com\/de#\/schema\/person\/4e0156a83ca71f429d1af500f8dac549"},"headline":"Evasive Malware: The Enemy You Can\u2019t See","datePublished":"2017-12-27T16:32:51+00:00","dateModified":"2021-04-09T15:51:15+00:00","mainEntityOfPage":{"@id":"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see"},"wordCount":777,"publisher":{"@id":"https:\/\/www.n-able.com\/de#organization"},"image":{"@id":"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see#primaryimage"},"thumbnailUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/12\/malware.jpg","articleSection":["Security"],"inLanguage":"de"},{"@type":"WebPage","@id":"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see","url":"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see","name":"Evasive Malware: The Enemy You Can\u2019t See - N-able","isPartOf":{"@id":"https:\/\/www.n-able.com\/de#website"},"primaryImageOfPage":{"@id":"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see#primaryimage"},"image":{"@id":"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see#primaryimage"},"thumbnailUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/12\/malware.jpg","datePublished":"2017-12-27T16:32:51+00:00","dateModified":"2021-04-09T15:51:15+00:00","description":"The rise of advanced AV engines has forced malware creators to take evasive action. Here\u2019s what you need to know about the new Evasive Malware.","breadcrumb":{"@id":"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see#breadcrumb"},"inLanguage":"de","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see"]}]},{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see#primaryimage","url":"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/12\/malware.jpg","contentUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/12\/malware.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.n-able.com\/de\/blog\/evasive-malware-enemy-you-cant-see#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Security","item":"https:\/\/www.n-able.com\/de\/blog\/category\/security"},{"@type":"ListItem","position":2,"name":"Evasive Malware: The Enemy You Can\u2019t See"}]},{"@type":"WebSite","@id":"https:\/\/www.n-able.com\/de#website","url":"https:\/\/www.n-able.com\/de","name":"N-able","description":"","publisher":{"@id":"https:\/\/www.n-able.com\/de#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.n-able.com\/de?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"de"},{"@type":"Organization","@id":"https:\/\/www.n-able.com\/de#organization","name":"N-able","url":"https:\/\/www.n-able.com\/de","logo":{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/www.n-able.com\/de#\/schema\/logo\/image\/","url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","contentUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","width":"1024","height":"1024","caption":"N-able"},"image":{"@id":"https:\/\/www.n-able.com\/de#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/NableMSP","https:\/\/x.com\/Nable","https:\/\/www.linkedin.com\/company\/n-able","https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw"]},{"@type":"Person","@id":"https:\/\/www.n-able.com\/de#\/schema\/person\/4e0156a83ca71f429d1af500f8dac549","name":"Nick Cavalancia","image":{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/secure.gravatar.com\/avatar\/4082bc26b8621c709a9d01d3269690e7760cce48ac67f8a46ea0a195818c1189?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4082bc26b8621c709a9d01d3269690e7760cce48ac67f8a46ea0a195818c1189?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4082bc26b8621c709a9d01d3269690e7760cce48ac67f8a46ea0a195818c1189?s=96&d=mm&r=g","caption":"Nick Cavalancia"}}]}},"_links":{"self":[{"href":"https:\/\/www.n-able.com\/de\/wp-json\/wp\/v2\/posts\/6160","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.n-able.com\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.n-able.com\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/de\/wp-json\/wp\/v2\/users\/51"}],"replies":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/de\/wp-json\/wp\/v2\/comments?post=6160"}],"version-history":[{"count":0,"href":"https:\/\/www.n-able.com\/de\/wp-json\/wp\/v2\/posts\/6160\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.n-able.com\/de\/wp-json\/wp\/v2\/media?parent=6160"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}