TrickGate crypter discovered after 6 years of infections

New research from Check Point Research exposes a crypter that stayed undetected for six years and is responsible for several major malware infections around the globe.

In new research, Check Point has exposed a crypter dubbed TrickGate developed by cybercriminals and sold as a service.

The crypter has been in development since 2016 when it was used to spread the Cerber malware, but it has been used for several major malware campaigns, including Trickbot and Emotet (Figure A).

Figure A

Jump to:

TrickGate’s massive distribution

Check Point monitored 40 to 650 attacks per week over the last two years and found the most popular malware family crypted by TrickGate was FormBook, an information stealer malware.

The threats crypted by TrickGate are delivered in different formats depending on the threat actor deploying it. All the usual initial compromise vectors can be used, such as phishing emails or abuse of vulnerabilities to compromise a server or computer, and the crypted files might be in archive files (ZIP, 7 ZIP or RAR) or in the PDF or XLSX format.

SEE: Mobile device security policy (TechRepublic Premium)

How did TrickGate stay undetected for so long?

Security researchers considered parts of the TrickGate code to be shared code that would be widely used by many cybercriminals, as is often the case in the malware development environment where developers often copy existing code from others and modify it.

When Check Point suddenly stopped seeing that code being used, they discovered that it had stopped deploying for several different attack campaigns at the exact same time. As it’s unlikely that different threat actors took vacation at the same time, the researchers dug further and found TrickGate.

TrickGate’s functionalities

Although the code analyzed by the researchers has changed over the last six years, the main functionalities exist on all samples.

It uses the API hash resolving technique to hide the names of the Windows APIs strings as they are turned into a hash number. It then adds unrelated clean code and debug strings inside the crypted file in order to raise false flags for the analysts and render the analysis harder.

TrickGate always changes the way the payload is decrypted so that automated unpacking for another version is useless. Once the payload is decrypted, it is injected in a new process by a set of direct calls to the kernel.

What can be done against the TrickGate threat?

The crypter/packer problem has been around for many years. As Check Point stated in the report: “Packers often get less attention, as researchers tend to focus their attention on the actual malware, leaving the packer stub untouched.”

Reverse engineers working on improving malware detection often focus on the malware itself because it can be packed or crypted with any crypter tool and it’s important to detect the final payload, which is the most malicious component of the attack.

Ideally, packer/crypter code should be considered the same as malware and raise alarms, but what makes it a difficult task is that legitimate packers do exist and should not be blocked.

Security solutions need to implement specific detections for crypters that are known to be malicious. Those detections are difficult to maintain as they need to be updated every time the crypter evolves.

Crypters render automated static analysis useless, as analysis tools will only see the crypter code and not the final payload. It is strongly advised to adopt security solutions that have the capability to do dynamic and behavior analysis, such as sandboxes, as those solutions will be able to monitor the whole code flow from the depacking to the delivery of the final payload and its execution.

Disclosure: I work for Trend Micro, but the views expressed in this article are mine.