“Segmented” malware

Question

I've been researching how anti-malware tools function and I feel like I'm missing something with heuristic analysis.

What I've learned so far
Anti-malware programs can use heuristic analysis and signatures to determine if a program is malware or not. Malware authors use polymorphic code to avoid the signature recognition and obfuscate the actions within the code to avoid some heuristics.

The scenario
If a malware author were to segment their code into a multitude of different binaries, could this be detected? I'm imagining a scenario where a simple keylogger that uses many polymorphic executables for logging keys, receiving commands, and sending data, so as to appear as benign tools.

I feel as though this could create a large amount of false-positives with programs that use one or two keybinds and other small tools.

My questions
Is this something that could be an effective way to avoid detection?
Are there any ways to protect from this, if there aren't already?

Answer 1

I've been writing malware for professional security tests for more than 20 years. Evasion of AV detection is one of the common requirements of our customers. The approach depends on which scanning mechanism shall be evaded.

Pattern-based detection is very simple in the AV environment. This is like a regular expression which tries to identify a common part of the specific malware. If the malware gets changed regarding this identification signature the detection won't work anymore. Changing code fragments (e.g. strings, internal names) or code block location in the binary are done quickly and will succeed.

A heuristic-based detection does something similar but not with code blocks but with “actions“. An action would be opening a file, writing a string and closing the file again. A suspicious sequence on a Windows file system might be creating a file and adding the hidden flag immediately to it. Most AV products declare this malicious. And in most cases it is (how many legitimate applications do this?). But if you wait a few seconds between these two tasks or do something else in between (like opening another file in the meanwhile) the heuristic will miss the original connection between the initial tasks.

Splitting the tasks into multiple binaries running like multi-threading instances might cause a similar effect. This is because AV software can't correlate that many actions from multiple processes. The challenge might be that you have to deploy all your binaries on the target host to establish your framework. But this might raise some flags during the heuristical analysis (multiple downloads, downloading another binary after execution or extracting multiple executables from within a single binary). I'm usually downloading additional parts and abandon the original “downloader“. This works well, generates small binaries and is efficient. AV detection works rather bad with ultra small and simple files.

I've never had a case where circumventing AV detection was not possible. It might just take more time than usual. This might be the reason why some people call AV snake oil.