A Systematical and longitudinal study of evasive behaviors in windows malware

Abstract

Malware is one of the prevalent security threats. Sandboxes and, more generally, instrumented environments play a crucial role in dynamically analyzing malware samples, providing key threat intelligence results and critical information to update detection mechanisms.In this paper, we study the evasive behaviors employed by malware authors to hide the malicious activity of samples and hinder security analysis. First, we collect and systematize 92 evasive techniques leveraged by Windows malware to detect and thwart instrumented environments (e.g., debuggers and virtual machines). Then, we implement a framework for evasion analysis of x86 binaries and analyze 45,375 malware samples observed in the wild between 2010 and 2019; we compare this analysis against popular, legitimate Windows programs to study the intrinsic characteristics of such evasive behaviors.Based on the results of our experiments, we present statistics about the adoption of evasive techniques and their evolution over time. We show that over the past 10 years, the prevalence of evasive malware samples had a slight increase (12%). Moreover, the employed techniques shifted significantly over time. We also identify techniques that are specific to malware, as opposed to being employed by both malicious and legitimate software. Finally, we study how the security community reacts to the deployment of new evasive techniques. Overall, our results empirically address open research questions and provide insights and directions for future research. Y ea r T a x o n o m y Dynamic-Static Analysis Longit. Malware vs # Evasive # Samples Analysis Goodware Techniques (# Families) Chen et al. [26] 2006 8 6,222 () Lindorfer et al. [14] 2011 14 1,500 (175) Branco et al. [27] 2012 51 4M () Barbosa et al. [28] 2014 51 12M( )

HyperDbg: Reinventing Hardware-Assisted Debugging

“…Anti-debugging and anti-virtualization techniques used in early malware [10] employ numerous evasion methods to hide or reduce malicious activities. These anti-detection methods are analyzed comprehensively in the recent study by Galloro et al [32] where over 92 classes of evasive techniques executed by modern malware.…”

Defeating Evasive Malware with Peekaboo: Extracting Authentic Malware Behavior with Dynamic Binary Instrumentation

“…If malware detects that it is being analyzed, it can cease execution, execute misleading behavior and hide its malicious intent. This delays classi cation of new malware, allowing it more time to in ict damage or extort more ransoms 18,19 . Evasive malware is widespread and uses varied obfuscation and anti-analysis techniques to defeat widely used static and dynamic analysis tools 10,[19][20][21] .…”

“…This delays classi cation of new malware, allowing it more time to in ict damage or extort more ransoms 18,19 . Evasive malware is widespread and uses varied obfuscation and anti-analysis techniques to defeat widely used static and dynamic analysis tools 10,[19][20][21] . Obfuscation is a technique used by malware authors to conceal the true intent and functionality of malicious code and involves modifying the malware using packing, encoding, metamorphism and polymorphism, which are all widely used and severely limit static analysis 3,11,22,23 .…”

“…Evasive malware is ubiquitous, Galloro, et al 19 and Sharma, et al 26 found that anti-analysis techniques were present in 80% and 99.36% of the malware samples they examined, respectively. Additionally, Ma a, et al 23 demonstrated that 68% of the malware samples they analyzed employed various forms of obfuscation, signi cantly limiting static analysis to the extent that it is not a viable option for malware analysis.…”

“…Dynamic analysis tools that include DBI, debuggers and sandboxes execute the malware or benign software in a controlled environment and are summarized in SupplementaryTable 1 30,31 . The anti-analysis techniques that target dynamic analysis tools are numerous and if the malware makes a determination it is under analysis it can hide it malicious intent, execute misleading behavior or cease execution 19,30 . Malware can probe its environment using Application Programming Interface (API) calls that interact with the user space of the Operating System (OS) and System calls that interact with the kernel, that is the core, of the OS.…”