• Hi there and welcome to PC Help Forum (PCHF), a more effective way to get the Tech Support you need!
    We have Experts in all areas of Tech, including Malware Removal, Crash Fixing and BSOD's , Microsoft Windows, Computer DIY and PC Hardware, Networking, Gaming, Tablets and iPads, General and Specific Software Support and so much more.

    Why not Click Here To Sign Up and start enjoying great FREE Tech Support.

    This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

TrickBot malware returns with some devious new tools


PCHF Tech News
Jan 10, 2015
A new sample of TrickBot has been discovered which checks the screen resolution of victim's machines in order to see if the malware is running inside a virtual machine.

In order to protect themselves and their systems when analyzing malware, security researchers often do so in a virtual machine. As a result of this, malware often employs anti-VM techniques to detect whether or not it is running in a virtual machine.

The anti-VM techniques used by malware include looking for particular processes, windows services, machine names and checking network card MAC addresses or CPU features.

If malware detects that it is indeed running in a virtual machine, it will stop its operations to avoid giving researchers further clues into how it works and who deployed it in the first place.

Screen resolution

Maciej Kotowicz from the cybersecurity firm MalwareLab found a new sample of the TrickBot Trojan that checks an infected computer's screen resolution to determine if it's a virtual machine.

TrickBot originally started out as a banking trojan but the malware has evolved to perform other malicious behavior including spreading laterally through a network, stealing saved credentials in browsers, stealing cookies and more.

Kotowicz first made his discovery public in a Tweet in which he revealed that a new sample of TrickBot is checking infected machines to see if they have a resolution of 800x600 or 1024x768. If either of these resolutions is found, TrickBot will stop running.

The reason the malware is checking for these two resolutions in particular is due to how researchers configure the virtual machines they use to analyze malware. When setting up a virtual machine, most researchers will not install the VM guest software that would allow them to use higher resolutions. Without this software installed, a virtual machine will usually not allow any resolutions other than 800x600 and 1024x768.

While unfortunate for researchers studying malware, this new anti-VM check is actually quite clever and hopefully other malware developers don't follow suit and add this feature to their malicious software.

Via BleepingComputer

Continue reading...