What is encrypted virus?

by
What is encrypted virus

An encrypted virus is a type of malicious software (malware) that encrypts its code to avoid detection. Viruses are programs that self-replicate by copying themselves into other executable code or documents. Encrypted viruses add an extra layer of protection by using encryption algorithms to scramble their code and data. This makes it more difficult for antivirus software to recognize the virus signature and stop the infection.

How encrypted viruses work

A typical virus infection proceeds in the following steps:

  1. The virus locates target files or systems to infect.
  2. It copies its code into the target host program or boot sector.
  3. The infected program executes and spreads the virus further.

An encrypted virus adds an extra obfuscation step to this process. It works like this:

  1. The virus encrypts its code and data using a mathematical algorithm.
  2. It appends or prepends the encryption module/routine to its encrypted body.
  3. The encryption routine decrypts the viral code when the infected program starts executing.
  4. The execution flow passes to the original virus code, which can now replicate and spread normally.

This encryption cycle repeats with each new infection. The key advantage is that the encrypted virus code is unreadable and undetectable as long as it is not executing. Antivirus scanners look for known virus signatures within code. By encrypting itself, the virus can evade signature-based detection.

Common encryption algorithms used

Encrypted viruses use a variety of encryption ciphers and algorithms to scramble their code. Some examples include:

  • XOR encryption: Each byte of data is XORed with a random byte used as a key.
  • RSA: Uses public-key cryptography with a public and private key pair.
  • RC4: A symmetric stream cipher using a variable-length key.
  • Blowfish: A symmetric block cipher with a 64-bit block size.

The encryption key may be hardcoded into the virus code, generated randomly, derived mathematically or based on some attributes of the victim file. The complexity and execution time of the encryption routine varies across virus families. Stronger algorithms like RSA require more computational resources.

Methods of infection

Encrypted viruses can infect systems and spread through all standard virus mechanisms, including:

  • Executable infection: Infecting executable Portable Executable (PE), ELF, Mach-O and other binary formats.
  • Boot sector infection: Overwriting the boot sector of storage media like hard disks and flash drives.
  • Script viruses: Infecting script files like JavaScript, VBScript, PowerShell and Python programs.
  • Macro viruses: Infecting Microsoft Office files with malicious macros.
  • Network propagation: Spreading over networks by exploiting vulnerabilities in services like SMB and RPC.

The most common targets are OS executables and boot sectors. Encryption provides resilience against cleaning techniques like antivirus scanning. Network spreading allows the virus to rapidly infect more systems.

Effects and damage potential

Encrypted viruses can compromise computer security and cause damage in the following ways:

  • Consume computing resources: The encryption routines require additional CPU and memory usage, which slows down the infected system.
  • Corrupt programs and files: Viral code may overwrite or damage executables and documents as part of the infection process.
  • Install backdoors: The virus payload may download additional malware or grant remote access to attackers.
  • Steal data: Sensitive data like passwords and financial information may be exfiltrated by the malware.
  • Disable security tools: Antivirus, firewall and other security programs may be stopped or uninstalled.
  • Deliver ransomware: Encrypted viruses can deploy ransomware modules that encrypt user data for extortion.

The malicious actions performed depend on the virus. Worms like WannaCry leverage encryption to spread quickly within networks while delivering ransomware payloads. Stealthier viruses may simply persist as latent infections.

Example: The Hyperion Virus

The Hyperion virus from 1988 is one of the earliest known examples of encrypted viruses. Here are some of its notable features:

  • Used XOR encryption to scramble viral code.
  • Employed a transient decoder module to decrypt itself.
  • Infected Amiga operating system executables.
  • Displayed a poem by Friedrich Schiller on infected systems.

Hyperion introduced many concepts used in later viruses like variable encryption keys and oligomorphic code that mutates itself to avoid signature detection. Early encrypted viruses had limited spreading capabilities. Later worms like ILOVEYOU demonstrated how encryption could be combined with mass-mailing to create superviruses.

Detection methods

Encrypted viruses can be detected using the following methods:

  • Behavior monitoring: Monitor system calls and network activity for suspicious actions indicative of malware.
  • Heuristics: Analyze code characteristics like encryption and self-modification to identify probable virus behaviors.
  • Emulation: Run the code in a sandbox to force decryption and analyze the revealed inner core.
  • Cloud databases: Check file hashes and signatures against crowd-sourced threat intelligence.
  • Memory scanning: Scan decrypted viral code and data when loaded in memory at runtime.

Combining these techniques provides protection against obfuscated malware. Machine learning models can also be trained to recognize encrypted virus behaviors and patterns.

Protection best practices

You can mitigate the risk of encrypted virus infections through these security best practices:

  • Use antivirus/anti-malware tools with behavioral analysis and machine learning capabilities.
  • Be wary of unsolicited attachments and software from untrusted sources.
  • Install patches and updates to eliminate security vulnerabilities.
  • Use firewalls to monitor and control network activity.
  • Create restricted user accounts with limited system privileges.
  • Take regular backups of critical data.
  • Educate employees on malware risks and response procedures.

IT teams should focus on developing threat detection capabilities across endpoints, networks and cloud environments. Businesses can also leverage threat hunting and intelligence services to identify early indicators of compromise.

Remediation steps

If a system is infected by an encrypted virus, these steps should be taken to remediate:

  1. Isolate the infected system to prevent further spreading.
  2. Restore from clean backups to return to a known good state.
  3. Scan with updated antivirus software to detect and remove malicious components.
  4. Change passwords and keys that may be compromised.
  5. Investigate data losses and unauthorized activities.
  6. Harden security controls to prevent reinfection.

In some cases, a complete rebuild of the infected system is required. Forensic analysis should be conducted to determine the infection entry point, payloads delivered and other impacted endpoints.

Preventing infections

Organizations can avoid infections by encrypted viruses and other malware through robust cybersecurity hygiene, including:

  • Patching vulnerabilities quickly
  • Following the principle of least privilege
  • Securing endpoints with antivirus and firewalls
  • Monitoring networks to detect anomalies
  • Developing incident response plans
  • Training employees on cyber risks
  • Segmenting networks to control lateral movement
  • Testing backups and restoration procedures

Adopting a layered “defense-in-depth” strategy is key. This integrates multiple controls across users, devices, networks, cloud environments and applications to mitigate malware risks.

The future of encrypted malware

Threat actors will continue developing advanced obfuscation techniques as encryption arms races escalate. Some emerging directions include:

  • Ransomware-as-a-service lowers the bar for entry.
  • Polymorphic malware mutates payload signatures dynamically.
  • Fileless attacks live entirely in memory without local artifacts.
  • Quantum malware may use unbreakable quantum encryption.

Defenders must also leverage cutting-edge technologies like artificial intelligence, machine learning and big data analytics to stay ahead of these threats. User education and empowerment will remain vital pillars of defense.

Conclusion

Encrypted viruses use cryptographic techniques to evade detection. They encrypt their code and decrypt themselves at runtime before activating their malicious payloads. While early examples like Hyperion were limited to infecting local files, modern encrypted worms like WannaCry can spread globally. A blend of next-gen behavioral analysis, emulation, AI and user training is needed to combat this persistent threat.