MMPC blog: Investigation of a new undocumented instruction trick

Baserk · Jun 25, 2013

On the Microsoft Malware Protection Center TechNet blog link;

While investigating some new malware samples this week, we came across a few interesting files that use a new trick with an undocumented instruction.
We had to do a bit of digging around the Intel instructions list to solve this little mystery. While it turned out that the trick itself isn't effective in complicating debugging and disassembly, we think it's worth sharing anyway, as we're now seeing three different malware variants using it.
One of the samples flagged by our systems (SHA1:3d85cc93115c1ebfdeba17b54d6570e06c1bb2f5) looked nothing out of the ordinary in the beginning. It has the usual custom packer to deter analysis and detection, and is malformed to confuse various tools:
...
Searching for these instructions revealed that they are undocumented FPU instructions, leading to incorrect disassembly in different reversing tools.
Because this had piqued our curiosity, we asked ourselves who employs this trick and when did it first appear in the wild.

The first sample we noticed using this trick reached our systems on January 10, 2013, from a VirusTotal submission. The sample (SHA1: 7403f5e5a88b26001295fd201d490fbb4854e061) is detected as Backdoor:Win32/Farfli.AV. This sample was not packed or protected in any way and was only using this instruction trick.
Since January we have also seen the Trojan:Win32/Danglo family and Backdoor:Win32/Zegost.B using this trick.
Click to expand...

Log in or Sign up

MMPC blog: Investigation of a new undocumented instruction trick

Baserk Registered Member

Log in or Sign up

MMPC blog: Investigation of a new undocumented instruction trick

Baserk Registered Member

Useful Searches