cybersecurity

This article examines obfuscation techniques used in popular malware families, and offers some insights into possible opportunities for automating unpacking of these malware samples.

We will examine these behaviors in samples we have observed, showing how to extract their configuration parameters through unpacking each stage. Performing this same process through automation would allow a sandbox performing static analysis to extract crucial malware configuration parameters from such samples.

Malware authors increasingly use advanced obfuscation techniques to evade sandbox detection, enabling widespread distribution. Static analysis is a process performed by sandboxes for examining samples, without directly executing them.

Adversaries use the following techniques to deliver popular malware families like Agent Tesla, XWorm and FormBook/XLoader:

• Code virtualization
• Staged payload delivery
• Dynamic code loading to introduce new code at runtime
• Advanced Encryption Standard (AES) encryption
• Creating multi-stage payloads that are self-contained within the original sample