In detail, evasion is one of the crucial steps in the malware landscape. It can be done in various ways with various techniques. Although we will not cover all the techniques used, this article compiles some of the evasion strategies used by criminals in the wild.
Environment awareness
When malware runs, it’s often essential to identify whether it is running inside a sandbox environment or virtual machine. We use this technique to extract and check the system’s configurations and terminate the malware execution if all the conditions are not in place. In short, the malware can be programmed to detect sandbox usernames such as “virtualbox,” “vmware,” “virtual,” hypervisor calls, sandbox processes, installed devices, breakpoint registers and dynamic link libraries.
Timing-based method
The time-based approach is a very effective technique for bypassing sandbox analysis because the malware is analyzed only during a limited period. This method includes several evasion methods, such as:
Extended sleep: The malware calls for extended sleep, such as 10 minutes. In this way, it stops its execution and escapes the sandbox analysis before the actual infection.
Logic bomb: The malware can schedule its execution, for instance, on a particular date and time.
Stalling code: The malware takes advantage of CPU cycles via malicious payloads to delay the process and terminates before the final infection.
User interaction
User interaction can occur in different ways, such as moving the mouse or clicking on something. The malware can detect if this type of movement happens in the target environment, including the sandbox. Malware can be developed to execute after some scrolling movements or when the user opens a folder. On the other side, understanding the mouse and keyboard inputs, analyzing the speed of movements, its coordinates, and whether something is being opened and executed during the click is a popular method for human-interaction detection. With this approach, criminals can efficiently control and assemble all the infection stages by just putting away false positives.
Domain, IP identification and internet connection
Malware developers often use this method to easily identify the target companies and their IP ranges and check if the target machine can connect to the internet. Maintaining an internet connection when a threat is running is essential because it allows criminals to download additional payloads and the malware configuration from the C2 server. This is a crucial behavior because the malware will not load its configuration into the memory if it fails the previous steps, and the target machine does not guarantee a valid internet connection in advance. From the point of view of a malware analyst, this can be a pain sometimes because it introduces more complexity and is time-consuming to analyze the threat.
Stegosploit
This technique is a way of hiding malicious code within images. In short, a new drive-by browser exploit can be created and delivered via a simple image file. These kinds of payloads are efficient because they are stealthy and undetectable. You can find more details about this method here.
Code obfuscation, encryption or compression
This is one of the most popular techniques in the malware landscape. Parts of the malware in the initial binary can be obfuscated or encrypted to bypass the static analysis and make it hard to understand. The malware developers simply encrypt the malware strings and decrypt them in runtime. With this approach, the malware analyst must understand and identify the block of code responsible for decrypting the content and the used key. Some popular trojan bankers such as Lampion, Javali, URSA, Maxtrilha and Grandoreiro use this technique to hide their content, including the hardcoded strings, the configuration such as the remote C2 server address, bot commands, what kind of information will be exfiltrated and gathered during the execution, the WinAPI loaded in runtime, and so on.
Final thoughts
Although this article presents only some of the most used techniques in the wild by malware developers, it’s important to track and keep in mind that more sophisticated and complex techniques are emerging every day. This can be thought of as the “Tom and Jerry game,” and monitoring and analyzing the threats is the best way to identify the criminals’ strategies. In a repository provided by CheckPoint, it’s possible to analyze, understand and implement the described techniques in C language. The repositor can be accessed here.
Sources:
Malware evasion tecniques, Gafety Malware Sandbox Evasion, apriorit
