Threat analysis specialists from time to time face tools where artificial intelligence acts not as an auxiliary element, but a full-fledged developer of malicious infrastructure - this is the case recorded when studying the new payload delivery system.
Walmart Global Tech analysts who have previously studied the previously described campaign called DeepLoad, discovered a separate, previously unknown file-free distribution system, called SpectrePate. If in previous variations it was assumed only partial participation of AI in the creation of tools of attackers, then the new study showed something else: artificial intelligence acted as the main architect and developer of the entire system.
The first version of the instrument was called the “PasteFast Panel”. It was a centralized board of delivery of PowerShell scripts and was distinguished by a well-thought-out structure: the builder automatically added to the load of the bypass of the anti-virus interface AMSI and encrypted the final file by XOR, so that each transmitted load was packed in its own way.
Special attention was paid to the queue system, designed for the mass simultaneous handling of infected devices: with a sharp increase in traffic, the panel cached the encrypted files in memory and excluded repeated requests from the same IP address, so as not to overload the control server. At the same time, requests from the operators themselves - for example, the creation of new loads - were processed as a matter of priority, bypassing the overall queue.
The second version of the system has become noticeably more complicated. It is built on the principle of “special” development, when the change in the text description of the task automatically changes the final code. This made it possible to turn a simple delivery script into a fileless download with a reflective load in memory and add a real-time-time-powered polymorphism engine.
At each contact of the infected device, the server collects a new, unique version of the load: substitutes random snippets of code from the internal repository, generates believable, but random features of Windows system call style, adds a meaningless “junk” code and at the end wraps the result in the XOR-encryption layer and Base64-coding. Because of this, antivirus solutions aimed at finding known signatures, in most cases can not identify such a load as malicious.
The design of the administrative panel was also completely given to ИИAI, which confirms that artificial intelligence in this case was responsible not only for malicious logic, but also for the user interface of the tool.
The authors note that the above technical information is informational in nature and are intended for protection, not for practical use. As signaling detection methods lose the effectiveness against such systems, organizations should focus on behavioral analysis and monitoring of PowerShell abnormal activity, rather than rely solely on traditional antivirus checks.
Walmart Global Tech analysts who have previously studied the previously described campaign called DeepLoad, discovered a separate, previously unknown file-free distribution system, called SpectrePate. If in previous variations it was assumed only partial participation of AI in the creation of tools of attackers, then the new study showed something else: artificial intelligence acted as the main architect and developer of the entire system.
The first version of the instrument was called the “PasteFast Panel”. It was a centralized board of delivery of PowerShell scripts and was distinguished by a well-thought-out structure: the builder automatically added to the load of the bypass of the anti-virus interface AMSI and encrypted the final file by XOR, so that each transmitted load was packed in its own way.
Special attention was paid to the queue system, designed for the mass simultaneous handling of infected devices: with a sharp increase in traffic, the panel cached the encrypted files in memory and excluded repeated requests from the same IP address, so as not to overload the control server. At the same time, requests from the operators themselves - for example, the creation of new loads - were processed as a matter of priority, bypassing the overall queue.
The second version of the system has become noticeably more complicated. It is built on the principle of “special” development, when the change in the text description of the task automatically changes the final code. This made it possible to turn a simple delivery script into a fileless download with a reflective load in memory and add a real-time-time-powered polymorphism engine.
At each contact of the infected device, the server collects a new, unique version of the load: substitutes random snippets of code from the internal repository, generates believable, but random features of Windows system call style, adds a meaningless “junk” code and at the end wraps the result in the XOR-encryption layer and Base64-coding. Because of this, antivirus solutions aimed at finding known signatures, in most cases can not identify such a load as malicious.
The design of the administrative panel was also completely given to ИИAI, which confirms that artificial intelligence in this case was responsible not only for malicious logic, but also for the user interface of the tool.
The authors note that the above technical information is informational in nature and are intended for protection, not for practical use. As signaling detection methods lose the effectiveness against such systems, organizations should focus on behavioral analysis and monitoring of PowerShell abnormal activity, rather than rely solely on traditional antivirus checks.
