New Adware Uses Interesting Technique To Avoid Detection

Being more of a nuisance than anything, adware doesn't see as many innovations as other forms of malware. Once in a while, an adware developer surprises the security researchers.

That happened recently when two researchers working for enSilo discovered an innovation in an adware strain, known as DealPly.

As Adi Zeligson and Rotem Kerner indicated in a recent blog post, DealPly has some interesting features bolted on, which make it much more adept than most other forms of adware at avoiding detection by antivirus programs.

The adware is typically installed on a target's machine by being bundled with a legitimate app.  Once it's installed, it will add itself to the Windows Task Scheduler and run every hour.  Each time it runs, it will contact its command and control server and request instructions.

Here's where things get interesting. DealPly was designed modularly and makes use of Virtual Machine Detection and Machine Fingerprinting techniques.

Microsoft SmartScreen is one of two major systems used to verify the risk of files and web addresses.  It's updated regularly with newly blacklisted sites.  Naturally, malware authors find this to be a problem because it only gives them a limited window of time before their code and malicious URLs wind up on the list.

DealPlay, however, contains code that seems to be based on a reverse-engineering of Microsoft SmartScreen. When it contacts its command and control server, it requests a list of hashes and URLs to query using the SmartScreen reputation server. Once it has its list of queries to make, it will send a JSON request to the SmartScreen API to see if the server will respond with any of the following:

• UNKN Unknown URL/File
• MLWR Malware related URL/File
• PHSH Phishing related URL/File

Essentially, this query allows DealPly to know whether it has been blacklisted.  If so, the software enters an idled state until it can be updated.  This allows DealPly's developers a something close to real-time mechanism to know when they need to update their code, allowing them to stay ahead of the curve.  Very clever.  Very clever indeed, and troubling to IT staff everywhere.  We can expect this technique to be copied by other malware developers, worldwide.