Stealth Virus is Stealthiest of All

There's a new mass mailing virus in town, and it's built to make life for AV researchers even more difficult.

Atak uses a variety of tactics in its attempts to escape antivirus analysis. Its main trick is to check to see if it's being run in a debugging environment. If so, it exits to avoid detection. The ploy prevents casual perusal of the code by researchers and (potentially) rival virus writers.

A possible bug, related to the way Atak checks its activation date, prevents it from being run in a "sandbox". A sandbox is a virtual environment commonly used by AV researchers to look at the behaviour of malware in a safe environment.

The Register


Popular posts from this blog

Civilisational Data Mining

The Nature of Nurture?