September 9, 2019 By David Bisson 2 min read

A new sample of the GootKit malware family evaded detection from Windows Defender by setting a path exclusion.

According to Bleeping Computer, malware researcher and reverse engineer Vitali Kremez analyzed a new sample of GootKit malware and found that it came with a way to bypass Windows Defender.

The bypass began when the malware sample ran some code to determine whether Windows Defender was running on the infected machine. If it was, GootKit executed a command to create a registry value as part of a User Account Control (UAC) bypass. It then progressed through a sequence of commands in which it whitelisted the malware executable path, thereby effectively shielding the sample from Windows Defender.

Bleeping Computer noted that this bypass would work even if Microsoft began detecting this particular GootKit sample in the future, noting that the malware’s path would still be hidden from Windows Defender in future attacks.

Malware Evasion Techniques Are Trending

The GootKit sample detected by Kremez isn’t the only threat to use evasion-based tactics in recent months. In July, Bleeping Computer reported on a sample of the TrickBot banking Trojan family that arrived with 12 new modules designed to disable Windows Defender and Microsoft Defender APT. About a month later, FortiGuard Labs observed a new Ursnif sample hiding its API functions and encrypting most data in its main module. Then, in early September, Cofense detected a phishing campaign that used SharePoint to evade email perimeter technologies in its effort to prey on banks.

How to Defend Against GootKit Malware

Security professionals can help defend their organizations against GootKit malware by using a unified endpoint management (UEM) solution to monitor all devices for suspicious activity and take any necessary precautions. Companies should also consider investing in artificial intelligence (AI)-based technology to defend against attacks that use evasion and other tactics to bypass traditional security solutions.

More from

Generative AI security requires a solid framework

4 min read - How many companies intentionally refuse to use AI to get their work done faster and more efficiently? Probably none: the advantages of AI are too great to deny.The benefits AI models offer to organizations are undeniable, especially for optimizing critical operations and outputs. However, generative AI also comes with risk. According to the IBM Institute for Business Value, 96% of executives say adopting generative AI makes a security breach likely in their organization within the next three years.CISA Director Jen…

Q&A with Valentina Palmiotti, aka chompie

4 min read - The Pwn2Own computer hacking contest has been around since 2007, and during that time, there has never been a female to score a full win — until now.This milestone was reached at Pwn2Own 2024 in Vancouver, where two women, Valentina Palmiotti and Emma Kirkpatrick, each secured full wins by exploiting kernel vulnerabilities in Microsoft Windows 11. Prior to this year, only Amy Burnett and Alisa Esage had competed in the contest's 17-year history, with Esage achieving a partial win in…

Self-replicating Morris II worm targets AI email assistants

4 min read - The proliferation of generative artificial intelligence (gen AI) email assistants such as OpenAI’s GPT-3 and Google’s Smart Compose has revolutionized communication workflows. Unfortunately, it has also introduced novel attack vectors for cyber criminals. Leveraging recent advancements in AI and natural language processing, malicious actors can exploit vulnerabilities in gen AI systems to orchestrate sophisticated cyberattacks with far-reaching consequences. Recent studies have uncovered the insidious capabilities of self-replicating malware, exemplified by the “Morris II” strain created by researchers. How the Morris…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today