VirusTotal Data Shows How Malware Distribution Leverages Legitimate Sites, Apps

Google-owned malware analysis service VirusTotal has published a report showing how threat actors abuse trust to bypass defenses and deliver their malware.

According to data collected by VirusTotal, legitimate websites and applications are often leveraged for malware delivery.

In some cases, legitimate applications and websites are directly abused. For instance, the company found that 0.1% of legitimate hosts for popular apps have distributed malware. In addition, 10% of the top 1,000 Alexa domains have been observed delivering suspicious files.

The apps themselves are also abused, with 4,000 samples analyzed by VirusTotal executing or packing legitimate application installers. Moreover, 98% of the samples that included legitimate installers in their PE resources were malicious.

“One of the most effective social engineering techniques consists of hiding malware by packaging it into installation packages with legitimate software. This becomes a supply chain attack when attackers get access to the official distribution server, source code, or certificates,” VirusTotal said.

While this technique is not as common as others, the company says it seems to be a ‘constant and slightly growing trend’.

Since 2021, the company has identified more than one million malicious samples that were signed, with 87% of them having a valid signature. Malware signed with stolen keys is likely more common than many expect.

VirusTotal has also reported seeing an increase in attackers mimicking legitimate applications, with Skype, Adobe Acrobat and VLC being the most targeted. When it comes to mimicking legitimate websites, attackers have most commonly targeted WhatsApp, Instagram and Amazon.

“When thinking about these techniques as a whole, one could conclude that there are both opportunistic factors for the attackers to abuse (like stolen certificates) in the short and mid term, and routinely (most likely) automated procedures where attackers aim to visually replicate applications in different ways,” VirusTotal noted.

It added, “Although less sophisticated, the aggregate effect of these techniques could lead to a bigger combined impact than more complex but less voluminous attacks. That’s why it seems there are good candidates to monitor at a global level how malware attackers abuse them, which can also help automatically detect suspicious samples before they hit the victim.”

Related: VirusTotal Shares Analysis of 80 Million Ransomware Samples

Related: VirusTotal Hacking Offers a Supercharged Version of Google Hacking

Related: VirusTotal Introduces ‘Collections’ to Simplify IoC Sharing