5

A rather theoretical question: Assuming there is memory with a malware inside it. The malware's goal is to detect if a legit application is about to delete contents of the memory.

If recognized, the malware would copy parts, which are not deleted yet, to other locations, which already have been deleted and thus effectively reverse the deletion process.

My questions are: how could a malware notice that a delete operation was initiated. And could the malware somehow recognize the addresses of the deletion process?

Of one considers deletion in terms of overwriting existing memory with a constant value (0 or 1), deleting a big file should lower the entropy of the memory contents. However, I believe this is not a reasonable approach.

  • Well, remember that everything a program does is really just asking the OS to do something. ie, a program to delete RAM (garbage collection or otherwise) is really just an interface between the programmer and the OS, which allows the programmer to ask the OS to delete the RAM. If your malware is IN the OS, it has the ability to detect, change, or otherwise play around with this method. Not really an answer, but a thought. Also, a user can just power off... – KnightOfNi Oct 23 '14 at 1:02
1

There have been more visible instances of "memory only malware" and I think from a practical perspective you would drive yourself bonkers trying to find that needled in the haystack. What could you possibly look for? Page_Execute_ReadWrite calls? Mutexes? Not only that problem (which calls to look for), but when malware begins hooking into other processes, you would be seeing a lot of conflicting issues with legit processes duped into doing something (false positives) along with trying to consistently analyze running (changing) memory calls, routines, subroutines, opens, closes, etc

So you ask: "how could a malware notice that a delete operation was initiated" and I pose: "this would vary, every malware writer is different, there could never be a static method to do this." An attacker could chain multiple variables to ensure they're always going to run without having to worry about whether someone is going to delete it. E.g.:

(pseudocode)

home=c:\Users\someone\appdata\hidden_folder\here

if [ $home >= 0 ]
   then
       call this other {app, dll, cab, zip, etc}
       run other
fi

"Check to see if I exist, if I don't open something to put me back home"

This would live outside of the active process in another minimal application/call. There would be no need to program it into the malware itself. Sort of like a dropper. A dropper isn't the malware itself, only a means to an end (go out and download the malicious file).

  • An interesting answer, but not to this question. The OP asked "how could malware detect the initiation of a RAM deletion process?" You answered the question "what methods does malware use to 'survive' memory deletion?" – KnightOfNi Oct 23 '14 at 0:59
  • Is there an easy way to hook into paging out? – munchkin Apr 21 '15 at 2:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.