Post Content Read More
Related Posts
New Meterpreter Backdoor Hides Malicious Codes Within the Image
New Meterpreter Backdoor Hides Malicious Codes Within the Image
ANY.RUN sandbox has analyzed a new strain of Meterpreter backdoor malware that leverages sophisticated steganography techniques to conceal its malicious payload within an image file.
The malware, dubbed “Meterpreter Backdoor,” is designed to evade detection by hiding its code in the first two rows of a seemingly innocuous image, using only the green and blue color channels from the RGB color space.
The attack begins with a .NET executable file containing a PowerShell script that downloads a PNG image from a remote command-and-control (C2) server. Although the image appears to be a picturesque landscape, it harbors a sinister secret.
The malware calculates a byte array from the image channels using the System.Drawing library and a specific formula: (149 & 15)*16) || (83^15) = 83.
New Meterpreter Backdoor
This formula extracts the hidden code from the image’s first two rows’ green and blue color values.
Get special offers from ANY.RUN Sandbox. Until May 31, get 6 months of free service or extra licenses. Sign up for free.
Once the byte array is obtained, the malware decodes it into ASCII characters, revealing a User-Agent string and the IP address of the C2 server to which the malware will attempt to connect.
This connection allows the attacker to issue commands and potentially gain unauthorized access to the compromised system.
The decoded information is then converted into a script that the malware executes, enabling it to establish a persistent backdoor on the infected machine.
This backdoor can be used for various malicious activities, such as data exfiltration, remote code execution, or further spreading of the malware within the network.
Here, you can find how the malware executes in the Windows Sandbox
Steganography: A Potent Weapon for Malware Delivery
Steganography, the practice of concealing information within seemingly innocuous data, has become an increasingly popular technique among cybercriminals.
Attackers can bypass traditional security measures and deliver their payloads undetected by hiding malicious code within images, audio files, or other multimedia content.
The Meterpreter Backdoor campaign highlights the sophistication and adaptability of modern malware authors. By leveraging steganography, they can effectively cloak their malicious activities, making it more challenging for security professionals to identify and mitigate threats.
“This campaign underscores the importance of adopting a multi-layered security approach that combines traditional signature-based detection with advanced techniques like behavioral analysis and machine learning,” said a cybersecurity expert. “Staying ahead of these ever-evolving threats requires constant vigilance and a proactive approach to cybersecurity.”
As the threat landscape evolves, organizations and individuals must remain vigilant and prioritize cybersecurity best practices, such as keeping software up-to-date, implementing robust access controls, and educating users on identifying and reporting suspicious activities.
The post New Meterpreter Backdoor Hides Malicious Codes Within the Image appeared first on Cyber Security News.
AI-Based Webshell Detection Model – Detailed Overview
AI-Based Webshell Detection Model – Detailed Overview
[[{“value”:”
While injection vulnerabilities are on the rise, Webshells have become a serious concern.
They allow attackers to gain unauthorized access and run malicious code on web servers.
For the correct detection of webshells with various forms, obfuscation techniques, and stealthy features, it is necessary to identify unique characteristics that differentiate them from innocent data.
The following cybersecurity researchers discovered that the AI and deep learning models can outperform traditional static and rule-based methods by using abstract features extracted from vectorized representations of code, opcodes, or network traffic:-
Mingrui Ma
Lansheng Han
Chunjie Zhou
However, an extensive examination of these AI-powered techniques should be conducted to understand their strengths, weaknesses, and future potential in fighting the ever-changing landscape of Webshells.
Document
Integrate ANY.RUN in Your Company for Effective Malware Analysis
Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:
Real-time Detection
Interactive Malware Analysis
Easy to Learn by New Security Team members
Get detailed reports with maximum data
Set Up Virtual Machine in Linux & all Windows OS Versions
Interact with Malware Safely
If you want to test all these features now with completely free access to the sandbox:
Technical Analysis
There has been a boom in artificial intelligence (AI) webshell detection recently, with every stage being optimized from data preparation to model creation.
Techniques range from attention mechanisms and word embeddings to abstract syntax tree analysis, opcode vectorization, pattern matching, session modeling from weblogs, and ensembling static and dynamic features.
Although these methods have surpassed traditional ones in terms of detection rate, they are still limited by their inflexible filtering rules and reliance on specific languages.
Unknown approaches combine unclear matching with recurrent neural networks to identify key webshell behaviors relating to data transmission or execution across different implementations.
On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free.
To keep up with evolving webshell threats, feature engineering should be further improved while new model architectures must be designed for better detection accuracy and reliability.
Besides this, to mine feature languages, authors used 1-gram and 4-gram opcodes and selected features using algorithms with the same n-grams.
They observed that integrating LR, SVM, MLP, and RF classifiers with weighted values to detect webshells caused slow detection speeds.
They also noted some limitations of both static and dynamic methods based on features consequently requiring a more complete set of these methods.
The major challenges encountered were unbalanced datasets, irrelevant features, and limitations in the detection algorithm.
Data imbalances were resolved through de-duplication, SMOTE, and ensemble learning.
Different deep learning approaches such as CNN and LSTM were tried out together with various fusion methods.
New techniques were designed to deal with issues like long script identification as well as feature engineering constraints taking into account privacy concerns surrounding data usage.
However, problems remained related to performance comparison among different systems and the large amount of data required for processing purposes.
Finally, at the source code level, where opcode conversion is limited, detection accuracy was found to be higher than any other level and layer according to them, but this might not always hold true.
The data representation for detecting webshells is still a topic of debate.
While source code contains more semantic information, it also encounters interlanguage problems, on the other hand, opcode, and static features can recognize new kinds at the cost of losing some data.
ASTs and flow traffic information have been suggested as other options because they can overcome the limitations imposed by programming languages, but these require elaborate pre-processing steps.
Although deep learning is good at capturing generalizations from concrete examples, it cannot handle very large inputs.
It has been found that models trained on imbalanced datasets perform poorly when presented with new instances.
Therefore, industries need to work together to create fairer representations, which will lead to better AI training sets for future use.
Is Your Network Under Attack? – Read CISO’s Guide to Avoiding the Next Breach – Download Free Guide
The post AI-Based Webshell Detection Model – Detailed Overview appeared first on Cyber Security News.
“}]] Read More
Cyber Security News
