{"id":4484,"date":"2018-04-15T19:42:23","date_gmt":"2018-04-15T14:12:23","guid":{"rendered":"https:\/\/qadit.com\/blog\/?p=4484"},"modified":"2018-04-15T19:42:23","modified_gmt":"2018-04-15T14:12:23","slug":"hackers-found-using-a-new-code-injection-technique-to-evade-detection-2","status":"publish","type":"post","link":"https:\/\/qadit.com\/blog\/hackers-found-using-a-new-code-injection-technique-to-evade-detection-2\/","title":{"rendered":"Hackers Found Using A New Code Injection Technique to Evade Detection"},"content":{"rendered":"

<\/p>\n

\n
\n

\nWhile performing in-depth analysis of various malware samples, security researchers at Cyberbit found a new code injection technique, dubbed <\/p>\n

Early Bird<\/b><\/p>\n

, being used by at least three different sophisticated malware that helped attackers evade detection.\n<\/p>\n

\nAs its name suggests, Early Bird is a “simple yet powerful” technique that allows attackers to inject malicious code into a legitimate process before its main thread starts, and thereby avoids detection by Windows hook engines used by most anti-malware products.\n<\/p>\n

\nThe <\/p>\n

Early Bird<\/a><\/p>\n

code injection technique “loads the malicious code in a very early stage of thread initialization, before many security products place their hooks\u2014which allows the malware to perform its malicious actions without being detected,” the researchers said.\n<\/p>\n

\nThe technique is similar to the <\/p>\n

AtomBombing code injection technique<\/a><\/p>\n

that does not rely on easy-to-detect API calls, allowing malware to inject code into processes in a manner that no anti-malware tools can detect.<\/p>\n

\nHow Early Bird Code Injection Works<\/h3>\n

\n