2

I know the era of the self spreading worm is over, but has this mechanism for determining if a machine has already been infected or not ever been used? When a virus runs it checks to see if the machine is already infected by searching for a string, for example a key named xyz in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft. If it's found it means the system has already been infected. If it's not found then the virus will make a new generation of itself, that searches for abc instead of xyz, create the registry entry abc, launch the new generation and delete itself.

In pseudocode

//initialize string matchMe to an arbitrary value
if(findThread(matchMe))
//machine already infected
else
 matchMe = getRandomString()
 addtoRegistery(matchMe)
 spawnNewGeneration(matchMe)
 deleteSelf();

This way it doesn't leave behind any easily tell-tail signs that an antivirus can look for.

  • 1
    The short answer is yes. A bit of a broad topic as there are multiple ways that a virus can use the registry to determine if it already exists. There's also unlikely to be a list of viruses that have used this method. – RoraΖ Jan 20 '15 at 12:13
3

So I have "Practical Malware Analysis" by Sikorski and Honig in front of me. They describe the use of threading, but I think the more popular form of what you're describing is a mutex. Malware can create mutexes at the kernel level with specific names using the KeInitializeMutex system call, and use that mutex to mark that system. If another piece of the same malware drops on the system it can then look to see if that named mutex is a) present, or b) owned by another process. If it is, then it is reasonable to assume that you've already infected the computer. Of course, it becomes a great signature for anti-virus and other pieces of competing malware.

They also describe the use of the registry. Malware can look for specific values in the registry, and achieve persistence by embedding itself as a service.

So yes, this technique is used. I believe some of the sample "malware" they ship with the book uses these techniques.

  • I've this about mutexes before and don't understand what you mean. Could you elaborate? A mutex is a function you call to lock a resource and pertains to programming e.g. computing.llnl.gov/tutorials/pthreads/#Mutexes – Celeritas Jan 21 '15 at 19:33
  • Very true. Windows has mutexes at the kernel level. This way, services and drivers can yield to other processes and not make a giant mess out of your OS. I'll edit my question for clarity. – Ohnana Jan 21 '15 at 19:52
  • "Of course, it becomes a great signature for anti-virus and other pieces of competing malware" right so that's what my idea was that if the marker used to id an infected system changes each "generation" then it would be much harder for the AV to identify an infection. – Celeritas Jan 21 '15 at 23:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.