Hello dear friends: haters , Alice, bunnies. 🐰🎩🎀
Sorry for the long absence, I'll try to write posts more often.
Today I want to tell you how hackers hide all kinds of malware from the eyes of antivirus software🧩🦠
Well, no, there are many ways. For example:
malicious dll files, modification of archives, encryption of viruses, shell codes, paloides, meromorphism, permutations, polymorphisms and many more.
Now I want to talk just about polymorphism🧬 , and provide articles on this topic !
Let's go !
So what is polymorphism?
The polymorphism of a virus is the existence of one virus in several forms. This means that each time the program runs, the code of the virus changes in a different form.
This is what we will look at next.
Well this is a virus which roughly speaking mutates at every start up in a different way to confuse the antivirus.
This mutations can be different assembler insertions with addition in stacks, random encryption and decryption - whatever you want, if it works to fool your system and antivirus with it.
Antivirus detects viruses, including looking for virus signatures. And here such changes on the fly - of course they are confused. There are methods to fight this, but more about them later 🔮
What are the changes:
At the level of the bytes that make up the body of the virus(Adding garbage and similar), at the level of operands(performing all sorts of operations), at the level of the virus function calls(to be called in a strange way), the algorithm of the virus itself.
This will prevent it from jumping around with stack actions:
push 0x74 ; Add our value to the stack
JMP >> JZ "jump of faith"
push offset Here
add esp, 8
And generation of garbage and random actions:
mov bp,A16Ch
mov cl,03h
add cl ,740Fh
ror bp,cl
mov cx,bp ;
mov bp,856Eh
or bp,740Fh
mov si,bp ;
mov bp,3B92h ;
add bp,si ;
xor bp,cx ;
mov cx,5;
sub bp,B10Ch
add cx, 1
Up to some more complex examples . Which you will see in the archtvet🧿
This beauty can be done not only with assembler, it can also be done with C++ and higher level languages .
There are ready engines for this kind of stuff, but I think it's better to do your own assembler inserts. After all, some anti-viruses detect different engine images❣️
Here are a few such engines
1)
Link 2)
Link 3)
Link 4)
Link ()So how do you deal with this, it's not just bad listening you came here🔑
People detect them with static or dynamic analysis by doing various manipulations and decryptions with the virus codes .
There is no silver bullet here🪄 , and can not be ( for crypting is different everywhere, and every time it is like an interesting detective story, where you need to find and decrypt the malware ) But in the future, we can analyze this topic in detail =) Or go to archive.
And what about the antivirus?
I will tell you gentlemen. It is really difficult for traditional anti-viruses to detect these viruses because they are not typical, but there are several methods:
Using heuristic scanning. If this virus is like a collection of virus parts - i.e. a previously undetected part is dangerous. Keeping the software up to date.
Heuristic analysis , can detect polymorphic viruses. This is a careful study of the structure of a potential threat, the programming logic and data for unwanted code, unusual instructions and the behavior of threats.
Detection of typical forms for some polymorphic engines.
I think that's about it. 🔆
Those who want detailed information about virus writing and protection should go to archive.
Thanks for reading ❤️
And remember, even if you eat a piece of gib, you won't die completely🍄
#polymorphic #anitivirus #attacks #virus #malware
