Under Atak
New mass mailer proves difficult to read
There's a new mass mailer in town, and it's built to make the work of analysts even more difficult than it already is.
The new meanie, which goes by the name of Atak, uses a few nifty tricks to escape analysis. First and foremost, it checks to see if it's being run in a debugging environment, and exits to avoid detection. This prevents casual perusal of the code by researchers and rival script kiddies alike.
Moreover, a possible bug (related to the way it checks for the activation date) prevents it from being run in a "sandbox" (a virtual test tube, used by researchers to observe the behavior of malware).
"I haven't seen such ruses used in a mass mailer in a long time. This piece of code is so sloppy, it's devious." declared Mircea Ciubotariu, BitDefender antivirus researcher.
Other than that, the virus makes a thorough job of scanning for valid e-mails, by checking (among others) even for the archives of the Moldavian-built "The Bat" mail client.
"I can't tell for sure where the writer is from, but there are some clues and hints of his whereabouts." Ciubotariu concluded.
Further information about the new virus is available in the BitDefender virus encyclopedia.
About BitDefender®
BitDefender is the creator of one of the industry's fastest and most effective lines of internationally certified security software. Since its inception in 2001, BitDefender has continued to raise the bar and set new standards in proactive threat prevention. Every day, BitDefender protects tens of millions of home and corporate users across the globe - giving them the peace of mind of knowing that their digital experiences will be secure. BitDefender solutions are distributed by a global network of value-added distribution and reseller partners in more than 100 countries worldwide. More information about BitDefender and its products are available at the company’s security solutions press room. Additionally, BitDefender’s www.malwarecity.com provides background and the latest updates on security threats helping users stay informed in the everyday battle against malware.
