Search Evasion Techniques
Names, Techniques, Definitions, Keywords
Search Result
34 item(s) found so far for this keyword.
API Hammering Sandbox Evasion
API hammering is a technique used to delay sandbox analysis and thus avoid malware capability analysis reporting. This technique consists of calling a large amount of benign APIs like "printf" in a loop.
GetForegroundWindow Sandbox Evasion
This technique uses the GetForegroundWindow and Sleep APIs to attempt to evade sandboxes. Many sandboxes do not alter the foreground window like a user would in a normal desktop environment.
It accomplishes this by making a call to GetForegroundWindow, which returns a handle to the current window. Then the malware sample will sleep for a short time, followed by another …
Execution Guardrails: Environmental Keying Defense Evasion [Mitre]
Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. Environmental keying is an implementation of Execution Guardrails that utilizes cryptographic techniques for deriving …
User Interaction (Are you human?) Sandbox Evasion
You can get an advantage against sandboxes by using user interaction techniques. For example, The average user has a username and password and as long as the user you are targeting does not enter their password correctly, you can prevent your malware execution and bypass the possible sandbox control.
Alienyze Packers
Alienyze is a software packer designed to compress executable files, allowing them to reduce the file size of their software as much as possible.
-
Anti-Debugger techniques that detect and fool present debuggers
-
Anti-VM techniques that detect sandbox & virtualized environments
-
Protection from disassemblers and software analysis tools
-
Hardware ID locking for making applications machine dependant
-
Integrity checks that detect code …
DTPacker Packers
DTPacker is a .NET packer or downloader which although seeing considerable variety in the first stage, uses a second stage with a fixed password as part of the decoding.
The main difference between a packer and a downloader is the location of the payload data which is embedded in the former and downloaded in the latter. DTPacker uses both forms. …
Debugger Evasion Defense Evasion [Mitre]
Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.
Debugger evasion may include changing behaviors based on the results of the checks for the presence of artifacts indicative of a debugged environment. Similar to Virtualization/Sandbox Evasion, if the adversary detects a debugger, they …
Evasion using direct Syscalls Antivirus/EDR Evasion
In the Windows operating system, conventional malware frequently utilizes strategies involving the invocation of specific functions from the kernel32.dll library, such as VirtualAlloc
, VirtualProtect
, and CreateThread
. A closer inspection of the call stack reveals that the functions employed from kernel32.dll eventually trigger corresponding functions within the ntdll.dll library. This is facilitated by the ntdll.dll library, which serves …
Detecting Virtual Environment Artefacts Sandbox Evasion
Qemu registers some artifacts into the registry. A malware can detect the Qemu installation with a look at the registry key HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0
with the value of Identifier
and the data of QEMU
or HARDWARE\\Description\\System
with a value of SystemBiosVersion
and data of QEMU
.
The VirtualBox Guest addition leaves many artifacts …
Detecting Hooked Function Sandbox Evasion
To avoid some actions on the system by the malware like deleted a file. Cuckoo will hook some function and performs another action instead of the original one. For example the function DeleteFileW could be hooked to avoid file deletion.