How can I determine if a malware sample is morphic? (polymorphic, metamorphic, etc)

Question

I want to do a malware test that specifically uses recent morphic malware samples (polymorphic, metamorphic, etc). There are a couple of good sources I can pull samples from, but I need to know if their signature will change or not.

The best idea I have so far is to use a tool to disassemble it so I can look at the Assembly code. Then get it to propagate and look at the code to see if there is a change.

Does anyone know of a better way to do this? I'm not even sure of a reliable way to make it propogate.

Answer 1

It depends on whether you want polymorphic or metamorphic.

Polymorphic usually means the malware which is capable of changing itself while distributing itself. So first thing to determine is whether malware is actually making copies of itself (most typically writing into network folders). Then you can see whether those copies are different. This could be confirmed either by static analysis (such as disassembly - time consuming) or dynamic analysis (emulation or sandboxing - faster). This is relatively rare nowadays.

Metamorphic usually means the malware is changed at the server, and everyone downloading it gets a different binary, even though all those binaries implement the same thing. This is very common nowadays. A specific sample you downloaded will always remain the same, and will make the same copies. However a sample someone else downloaded would be different from yours. Trying to download several copies, including different source IPs (ideally via local connectivity, less ideal VPS, much less ideal VPN) and spread in time (i.e. every few hours) would get you lots of samples.

Answer 2

This is my understanding.

Polymorphic means that the body of the malware/exploit change o every iteration, this in general is doing by using encryption methods, basic or advanced.

On the other hand, Metamorphic means that some parts of the malware/exploit can change but in general without using encryption methods. In general the Metamorphic techniques are on the nopsled vector of the exploits (this vector is used basically for increase the IP register of the processor).

You can find more information on this article PolyVaccine: Protecting Web Servers against Zero-Day, Polymorphic and Metamorphic Exploits, but bear in mind that there is a lot of articles explaining this techniques.

And in response to your question, the only way to know if a malware is polymorphic or metamorphic is by reverse engineer basically, you can also execute the sample and see how works, but you will need to do RE for sure.