Stealthy Malware Leveraging Variable Functions and Cookies for Evasion
Cybersecurity researchers at Wordfence Threat Intelligence have identified a persistent trend in new malware using sophisticated obfuscation techniques to evade detection.
Cybersecurity researchers at Wordfence Threat Intelligence have identified a persistent trend in new malware using sophisticated obfuscation techniques to evade detection.
Malware often employs obfuscation through variable functions and cookie manipulation to conceal its activities. This report examines these mechanisms and discusses methods for detection and mitigation.
The PHP language feature of executing functions named by variable values is often exploited by attackers. For example, function names like 'eval' and 'base64_decode' are stored in variables and called dynamically, allowing arbitrary code execution on servers.
Cookies, typically used for storing user preferences, are weaponized to carry encoded malicious scripts. The malware assembles function names or code dynamically by concatenating and decoding cookie values, bypassing traditional scanners.
One malware strain utilizes exactly 11 cookies to assemble function names and code segments. It concatenates cookie values to form function names like 'base64_decode' and decodes further cookie data to execute dynamic functions.
Malware often employs obfuscation through variable functions and cookie manipulation to conceal its activities.
Another sample uses boolean conditions and str_replace to transform obfuscated strings into function names, executing serialized payloads from cookies.
A third example checks for 22 cookies and uses chained variable function calls to build and execute anonymous functions, adding complexity to detection.
Despite obfuscation, malware exhibits identifiable patterns, including dense obfuscated code, excessive array lookups, and reliance on superglobals like $_COOKIE. Behavioral and heuristic detection of these patterns is effective.
Wordfence premium signatures detect over 99% of variants by targeting these traits. Tools like Wordfence CLI enable deep scanning, even in damaged WordPress installations.
Ongoing updates to threat intelligence databases and collaboration with threat intelligence teams are crucial in combating emerging threats.
Variable functions and cookie manipulation remain effective malware evasion methods, requiring continued vigilance and research from security teams.
Collaborating with threat intelligence teams by sharing samples aids in protecting the community from emerging attacks. The fight against sophisticated malware relies on proactive defenses and community collaboration.
Based on reporting by GBHackers.