5 ms·

> How on earth can this be effective? It's not. > Did malware authors just forgot about all those and went back to trivial “everyone gets the same image” stra

by lawl 6y ago

> How on earth can this be effective? It's not. > Did malware authors just forgot about all those and went back to trivial “everyone gets the same image” strategy? No. But if you make your thing as polymorphic as possible and deliver that automated, i take 1000 samples and look what doesn't change to make a signature. Also these things exist as webservices these days and criminals pay per use to generate fresh undetected executables. Just makes more sense to only release a new binary once it had been detected, even if it's just a button click and could be easily automated.

theamk 6y ago
Why not both? Trivial change (like embedded timestamp in a file) for every user, and advanced polymorphism for the times when the malware is detected. I bet most researchers have tools to bin files together automatically based on the same MD5. Why make their life easier when this is so easy to defeat?
- tgsovlerkhgsel 6y ago
  Because many AV systems assume that any unknown file (unknown to their cloud service) is probably doing this, and thus probably malware.
MertsA 6y ago
>I take 1000 samples and look what doesn't change to make a signature. There's fully metamorphic viruses where even the code mutating part is changed. Algorithmically it's equivalent but there's no "static" portion of the virus.
- lawl 6y ago
  > There's fully metamorphic viruses where even the code mutating part is changed. Algorithmically it's equivalent but there's no "static" portion of the virus. Never seen it play out that way. There's always something in practice. See you just talked about randomizing the code. But a windows PE isn't just code. It also has an icon. And yes i've seen AVs detect specific icons. In theory it's easy to not have anything static, in practice, that's the cat and mouse game you're playing.
  - MertsA 6y ago
    Look into Mistfall. It would infect other executables by splitting them into basic blocks that end with some branching instruction and inserting metamorphic portions of itself in between blocks and fixing up all of the modified addresses. There literally isn't any "static" portion. Here's a mirror of the author's site, he is Russian but there's a ton of English translations and articles that are a great read. http://z0mbie.daemonlab.org/ http://z0mbie.daemonlab.org/
  - account42 6y ago
    > But a windows PE isn't just code. It also has an icon. And yes i've seen AVs detect specific icons. And that's how you get overzealous AVs marking executables because they happen to have PE headers...

by lawl 6y ago

theamk 6y ago

Why not both? Trivial change (like embedded timestamp in a file) for every user, and advanced polymorphism for the times when the malware is detected. I bet most researchers have tools to bin files together automatically based on the same MD5. Why make their life easier when this is so easy to defeat?

tgsovlerkhgsel 6y ago
Because many AV systems assume that any unknown file (unknown to their cloud service) is probably doing this, and thus probably malware.

MertsA 6y ago

>I take 1000 samples and look what doesn't change to make a signature. There's fully metamorphic viruses where even the code mutating part is changed. Algorithmically it's equivalent but there's no "static" portion of the virus.

lawl 6y ago
> There's fully metamorphic viruses where even the code mutating part is changed. Algorithmically it's equivalent but there's no "static" portion of the virus. Never seen it play out that way. There's always something in practice. See you just talked about randomizing the code. But a windows PE isn't just code. It also has an icon. And yes i've seen AVs detect specific icons. In theory it's easy to not have anything static, in practice, that's the cat and mouse game you're playing.
- MertsA 6y ago
  Look into Mistfall. It would infect other executables by splitting them into basic blocks that end with some branching instruction and inserting metamorphic portions of itself in between blocks and fixing up all of the modified addresses. There literally isn't any "static" portion. Here's a mirror of the author's site, he is Russian but there's a ton of English translations and articles that are a great read. http://z0mbie.daemonlab.org/ http://z0mbie.daemonlab.org/
- account42 6y ago
  > But a windows PE isn't just code. It also has an icon. And yes i've seen AVs detect specific icons. And that's how you get overzealous AVs marking executables because they happen to have PE headers...