New Malware has the Power to Detect Virtual Machines
Malware can now detect and infiltrate virtual machines like a Cold War spy. One of the most effective ways to combat malware is to use virtual machines such as Sandbox,
because if malicious software is only able to operate within the scope of the virtual machine, it will not spread to the rest of the system. But Trojans are evolving and their creators are finding ways to detect and infect virtual machines.
This was discovered by Kilb Fenton and by security company SentinelOne . This new form of malware will be able to infiltrate into virtual machines; apparently by analyzing a number of documents, such as Word files on the virtual machine.
The process is that the malware becomes invisible once it is found in the virtual machine and does its best to hide itself to stay away from all diagnostic techniques.
Security researchers can use virtual machines to learn different parts of a malware, but the new algorithm will allow the malware to reproduce itself.
In a specific example discovered by Fenton ,
Malware can find a virtual machine to find Microsoft Word documents through the Recent Documents Windows feature.
Anti-Sandbox malware can detect the system’s IP and flee from the computers that have blacklisted the malware on their security system.
Again, if the malware detects that it is trapped, it deliberately hides all its activities so that it is not detectable.
Although this technique is relatively new and reflects the evolution of Trojans in the war between viruses and antiviruses, extending the life of malware can be a longer way to improve their viability, although in most cases it is harder to build than kill it.
Ads Blocker malware (don’t get confusing with Ad Blocker) displays ads by hiding in the phone’s memory.
An ad blocker software available outside the Google Play Store has surprised Android users with a large volume of ads, many of which are vulgar.
Since the software is cleverly unseen from the user’s eyes,
it is difficult to remove and makes things worse for the user.
According to a document released by Malwarebytes, an anti-malware company, the software,
call Ads Blocker (not to be confuse with Ad Blocker),
uses numerous tricks to unwittingly and frequently bombard users with ads.
The first requirement that users encounter when installing this malware is to display permissions on other software.
Next,
Ads Blocker creates a VPN connection and monitors network traffic. Finally, the malware adds a widget to the smartphone homepage by requesting users permission.
In fact, user-approved VPN connection, which is a required standard in many legitimate ad-blocking programs, allows the malware to be running in the background.
This, along with permission to appear in other applications, helps Ads Blocker to display ads in abusive and unauthorized ways.
The ads that this malware shows are all over the page. The program displays ads not only in the default browser, but also on the notification page.
The same goes for the widget already installed. Nathan Collier , a Malwarebytes researcher, said in the document:
Android malware [Ads Blocker] is ruthless in terms of frequency and advertising capabilities and capabilities. The fact is that while writing this text, this [malware] repeatedly displayed one ad every few minutes on my test machine.
Collier goes on to say that the content of ads displayed covers a wide range, some of which are unpleasant and in some cases even vulgar.
As annoying as this fake ad blocker is, it is equally difficult to remove. Even no malware icons are displayed on the phone’s screen.
There is no mention of Ads Blocker in the app info section in the Android settings (App info). Because the program with its white cardi bears its original name.
Malware’s secrecy means that many people are constantly trying to remove it. Ads Blocker displays another icon with the same white box on the notification page that is pressed, creating a dialog box and trying to install more advertising programs.
Collier then remove it by searching for an entry in the App info settings, which was An store at 1.2 MB. Users can also remove the malware in the same way.
Of course,
this method is not very useful in version 7 of the Android operating system because of the lack of app volume in the App info settings. Another alternative is to access the storage in Android settings and select the Apps tab.
Although the software’s name and icon may not be display as previously state, it can be detect base on the size of the 2.5 MB malware.
In this case,
users should immediately press the clear cache and clear cache icons by pressing the section on the 4.8MB input
and entering the corresponding part and then uninstall the program. . People can also remove malware with the free Malwarebytes app for Android.
Malwarebytes researchers still don’t know how Ads Blocker malware is distributing. VirusTotal scan service data from the research firm indicates that the reason for the spread of the malware in the United States is the likely use of third-party software stores.
The post, posted in an online forum in Europe and in German, provides evidence that indicates the potential for Ads Blocker malware to spread in Europe.
The Malwarebytes app has so far found only 1 out of 7 instances of malware infected.
Researchers at the company believe that the total number of infected devices is far higher than the figures.
