4

How is it possible for malicious programs to hide using polymorphic cryptography when programs must be first compiled into machine code? You cannot cryptographically hide machine code, can you? Then the processor wouldn't be able to execute it. However, wouldn't it be then simple to identify malware threats once it hits machine code in memory?

  • So many threats at the moment are executed through scripting engines. Powershell.exe and browsers running JavaScript are already compiled and won't change, but their parameters and payload may be decrypted on the fly. Additionally, cryptography is used heavily in good C&C communications. – armani Dec 18 '15 at 21:01
  • Works like a charm: veil-framework.com/framework/veil-evasion uses crypto and other methods to hide trojans. – dylan7 Dec 18 '15 at 21:53
  • Is there any detailed documents regarding how Veil actually works? – thatguylowjwj Dec 19 '15 at 0:36
  • @thatguylowjwj interestingly enough it's open source! From when I last looked at it the code it wasn't documented very well. However, it does work, so you might learn something from it. You can try it on Avast. Depending on which mode you chose some may work a couple times and then avast will catch it. They just ask you don't submit any of the code for testing by Antivirus companies :). They have someway build in to test if the mode still works. It works well with Metasploit framework. – dylan7 Dec 19 '15 at 1:54
4

Polymorphic malware may not do the same actions in the exact same way every time. Antimalware programs will need to be able to interpret the outcome of a set of actions which may not very reliable if the malware author does well with making the actions seem benign and trigger false positives.

Even when boiled down to machine code, you can do the same action in a wide variety of ways. I don't know machine code so I won't write any but for a really simple instance, there are many ways to go about adding two numbers:

x + y = z  
x - -y = z  
|-x - y| = z  
y + x = z  
y - -x = z  
|-y - x| = z  

So even if the program decrypts its own code during runtime to avoid having itself be identified by antimalware software, it can still act in a variety of ways to achieve the same outcome.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.