Prevalent Characteristics in Modern Malware (slides)

MrBrian · Aug 9, 2014

From https://www.blackhat.com/us-14/archives.html#prevalent-characteristics-in-modern-malware:

Two years ago, in 2011, we presented (with other researchers) at Black Hat USA a wide range of anti-reverse engineering techniques that malware were currently employing. For each technique, we documented how it works, we created an algorithm to detect its usage, and we provided statistics on the technique prevalence in a 4 million samples database. We also provided a fully-working PoC implementing each of the techniques (either in C or Assembly). Our expectation was that the AV industry would use our ideas (proven with the prevalence numbers) to significantly improve the malware prevention coverage. Nothing changed. In the meanwhile, we improved our detection algorithms, fixed bugs, and expanded the research to 12+ million samples.

In this talk, we are going to give another try and demonstrate the prevalence of more than 50 non-defensive additional characteristics found in modern malware. Additionally to that, we also extended our previous research demonstrating what the malware does once it detects it is being analyzed. The resulting data will help security companies and researchers around the world to focus their attention on making their tools and processes more efficient to rapidly avoid the malware authors' countermeasures.
Click to expand...

The presentation references paper "Scientific but Not Academical Overview of Malware Anti-Debugging, Anti-Disassembly and Anti-VM Technologies" from http://research.dissect.pe/.

"Anti-VM" was found in 81.4% of samples (page 19)!!?

deBoetie · Aug 12, 2014

The 81.4% with Anti-VM does sound implausibly high, although that would be the standard analysis condition.

The higher the better as far as I'm concerned, provided the malware exits as a result! I do most of my internet facing stuff from a VM.... In any case, revert-to-snapshot hopefully completes the treatment.

Log in or Sign up

Prevalent Characteristics in Modern Malware (slides)

MrBrian Registered Member

deBoetie Registered Member

Log in or Sign up

Prevalent Characteristics in Modern Malware (slides)

MrBrian Registered Member

deBoetie Registered Member

Useful Searches