Increased Use of a Delphi Packer to Evade Malware Classification

guest · Sep 21, 2018

Increased Use of a Delphi Packer to Evade Malware Classification
September 20, 2018
https://www.fireeye.com/blog/threat...i-packer-to-evade-malware-classification.html

The Delphi programming language can be an easy way to write applications and programs that leverage Windows API functions. In fact, some actors deliberately include the default libraries as a diversion to hamper static analysis and make the application "look legit" during dynamic analysis.
User Activity Checks
The packer goes to great lengths to ensure that it is not running in an analysis environment. Normal user activity involves many application windows being rotated or changed over a period of time. [...] If it does not see the change of windows, it puts itself into an infinite sleep.
[...] To confirm user activity, a second variant of the packer checks for mouse cursor movement.
Conclusion
Packers and crypter services provide threat actors an easy and convenient option to outsource the workload of keeping their real payloads undetected and unclassified as long as possible. They are regularly finding nifty ways to bypass sandbox environments with anti-analysis techniques
Click to expand...

Log in or Sign up

Increased Use of a Delphi Packer to Evade Malware Classification

guest Guest

Log in or Sign up

Increased Use of a Delphi Packer to Evade Malware Classification

guest Guest

Useful Searches