This previously unknown malware has some crafty tricks for avoiding antivirus

Pls share this post

Listen to this article

Cybersecurity researchers from Trend Micro have uncovered a brand new piece of malware that uses an unusual method of hiding from antivirus programs.

The malware is called UNAPIMON, and is apparently being used by Winnti, an established Chinese state-sponsored threat actor that was behind some of the most devastating attacks against governments, hardware and software vendors, think tanks, and more.

According to Trend Micro, many malware variants are using a method known as API hooking to eavesdrop on calls, grab sensitive data, and tweak different software. Therefore, many security tools also use API hooking to track the malware.

Would you use a phone with no apps? One of the world's largest mobile networks believes you will — but I am not totally convinced

Simplicity and originality

“With UNAPIMON, things are different. It uses Microsoft Detours for hooking the CreateProcessW API function, which allows it to unhook critical API functions in child processes. As a result, it successfully evades antivirus detection. 

A unique and notable feature of this malware is its simplicity and originality,” Trend Micro said in its report. “Its use of existing technologies, such as Microsoft Detours, shows that any simple and off-the-shelf library can be used maliciously if used creatively. This also displayed the coding prowess and creativity of the malware writer.”

“In typical scenarios, it is the malware that does the hooking. However, it is the opposite in this case.”

READ ALSO  Google unveils its first data center processor as it joins Microsoft and Amazon in a billion-dollar hardware race — Intel and AMD will be nervous to see strategic partners turn into formidable x86 rivals

Using Microsoft Detours in this regard has other benefits, too, the researchers explained. As this is a legitimate debugging tool, it even evades behavioral detection. 

In its writeup, BleepingComputer described Winnti hackers as “known for their novel methods of evading detection when conducting attacks.”

Back in 2020, the group was spotted abusing Windows print processors to hide a piece of malware and persist on the target network. Two years later, they broke a Cobalt Strike beacon into more than a hundred pieces, and only reconstructed it when they needed to use it.

More from TechRadar Pro

READ ALSO  Google restricts Gemini AI in answering election-based questions


Pls share this post
Previous article
Meta teases its next big hardware release: its first AR glasses, and we’re excited
Next articleThe Fed’s timing for interest rate cuts won’t have anything to do with the presidential election, Powell says