Kurt Baumgartner PC Tools
From Autorun to Zbot, behavioural technologies ignore the most effective evasion strategies implemented in malware families' packers and protection. However, proper research and analysis cannot ignore such capabilities. This paper will explore some of the most effective and prevalent techniques, and compare antiRE across the most prevalent families of 2008 and the first half of 2009.
Peter Ferrie has compiled an impressive list of antiRE techniques, but are they used and in the wild? Are they in prevalence in 2009? If not, what is? Privileged instructions and mangled exception handlers, quirky stack modifications with returns into thread creation routines in the windows loader, spaghetti flow jmp patterns, garbage api calls with invalid parameters and a variety of methods will be fully analysed in depth. Waledac, Koobface, Sinowal, Taterf and Zbot are just a few of the families that we will dissect and compare, and we will examine evasion data surrounding each of these unfortunately effective implementations.
