Search Evasion Techniques
Names, Techniques, Definitions, Keywords
Search Result
34 item(s) found so far for this keyword.
Stalling Code Sandbox Evasion
This technique is used for delaying execution of the real malicious code. Stalling code is typically executed before any malicious behavior. The attacker’s aim is to delay the execution of the malicious activity long enough so that an automated dynamic analysis system fails to extract the interesting malicious behavior.
Checking Recent Office Files Sandbox Evasion
Another way to detect if the malware is running in a real user machine is to check if some recent Office files was opened.
GetTickCount Anti-Debugging
This is typical timing function which is used to measure time needed to execute some function/instruction set. If the difference is more than fixed threshold, the process exits.
GetTickCount
reads from the KUSER_SHARED_DATA
page. This page is mapped read-only into the user mode range of the virtual address and read-write in the kernel range. The system clock tick updates the …
Geofencing Others
Geofencing in malware refers to a technique used by cybercriminals to restrict the distribution or activation of malicious software based on geographical location. Malware authors use geofencing to target specific regions or avoid certain areas, such as their home country, in order to evade detection, minimize the chances of being investigated, or maximize the effectiveness of their attacks.
Geofencing works …