{"id":2546,"date":"2016-08-24T16:08:36","date_gmt":"2016-08-24T09:08:36","guid":{"rendered":"https:\/\/humanit.asia\/?p=2546"},"modified":"2019-07-22T15:01:34","modified_gmt":"2019-07-22T08:01:34","slug":"zepto-evasion-techniques","status":"publish","type":"post","link":"https:\/\/old.humanit.asia\/th\/zepto-evasion-techniques\/","title":{"rendered":"Zepto Evasion Techniques"},"content":{"rendered":"
\n

We\u2019ve been tracking some more spam dropping Zepto ransomware variants. Like earlier posts<\/a>, we\u2019re seeing infected attachments with malicious macro scripts used as the entry point for the threat actor. (See images below of some recent spam samples.)<\/p>\n

As we dig deeper into our analysis, we found out that these macro scripts are not crafted manually. The malware authors have automated the creation and obfuscation of their code. This type of random obfuscation is one way of evading antivirus engines. As outlined below, our research highlights several methods employed to dynamically evolve the attack vector to circumvent detection.<\/p>\n

From the malicious emails we have gathered, we will examine the attachments to analyze key differences and common characteristics.<\/p>\n

The malicious code was written and spread across the 3 sub modules:<\/p>\n

\"zepto<\/a><\/p>\n

5 sub modules are being used for the malicious code:<\/p>\n

\"zepto<\/a><\/p>\n

Examining the sub modules of the file shows that it has some common signatures that we can look for:<\/p>\n

\"zepto<\/a><\/a><\/p>\n

We were able to find blocks of code that shares common structures. Remember that these codes were found on a different part or index of the module. From programmer\u2019s perspective, this may seem a little odd to see codes like this, but as the analysis continues, we can say that this is just one part of the malware author\u2019s strategy\u00a0to hide the code and confuse incident responders.<\/p>\n

Notice the highlighted strings from both screenshots that are common across\u00a0the two samples. At first glance, some significant strings can be formed only if the garbage strings such as:<\/p>\n