ANY.RUN Details How Threat Actors Use Obfuscators to Mask Malware
DUBAI, UNITED ARAB EMIRATES, February 14, 2024 /EINPresswire.com/ -- ANY.RUN, a cloud-based sandboxing service, published its first article in the series on the use of malware obfuscators, software tools that scramble code to make it difficult to understand and reverse engineer.
๐๐ก๐ ๐๐ก๐๐ฅ๐ฅ๐๐ง๐ ๐ ๐จ๐ ๐๐๐๐ฎ๐ฌ๐๐๐ญ๐๐ ๐๐จ๐๐:
Modern malware often employs obfuscation techniques to hinder analysis and detection. This creates a significant challenge for security researchers who need to understand the code's functionality and potential harm. This article series aims to equip individuals with the knowledge to tackle obfuscated code with confidence.
๐๐ฎ๐ข๐ฅ๐๐ข๐ง๐ ๐ ๐๐ข๐ฆ๐ฉ๐ฅ๐ ๐๐๐๐ฎ๐ฌ๐๐๐ญ๐จ๐ซ
The series starts by taking readers through the creation of a simple obfuscator written in .NET. This hands-on approach provides a clear understanding of the basic techniques used, including:
โข ๐๐ซ๐จ๐ฑ๐ฒ ๐๐ฎ๐ง๐๐ญ๐ข๐จ๐ง๐ฌ: Hiding strings within separate functions with complex names.
โข ๐๐ก๐๐ซ๐๐๐ญ๐๐ซ ๐๐ซ๐๐๐ค๐๐จ๐ฐ๐ง: Splitting strings into individual characters for further obfuscation.
โข ๐๐ฎ๐ฆ๐๐ซ๐ข๐ ๐๐จ๐ง๐ฏ๐๐ซ๐ฌ๐ข๐จ๐ง: Replacing characters with their numerical values to mask their meaning.
โข ๐๐๐๐ฏ๐ฒ ๐ฆ๐๐ญ๐ก: Utilizing complex mathematical expressions to represent characters.
โข ๐๐จ๐ง๐ญ๐ซ๐จ๐ฅ ๐
๐ฅ๐จ๐ฐ ๐๐ซ๐๐ฉ๐ก (๐๐
๐) ๐จ๐๐๐ฎ๐ฌ๐๐๐ญ๐ข๐จ๐ง: Shuffling code blocks while maintaining functionality.
๐๐ญ๐ญ๐๐๐ค๐ข๐ง๐ ๐ญ๐ก๐ ๐๐๐๐ฎ๐ฌ๐๐๐ญ๐จ๐ซ
The article then demonstrates how seemingly complex obfuscation can be bypassed using various methods, such as:
โข ๐๐ญ๐ญ๐๐๐ค๐ข๐ง๐ ๐ญ๐ก๐ ๐๐๐๐ฎ๐ฌ๐๐๐ญ๐จ๐ซ: Pausing code execution at key points to inspect variables and memory.
โข ๐๐๐ฆ๐จ๐ซ๐ฒ ๐๐ฎ๐ฆ๐ฉ๐ฌ: Analyzing memory snapshots to reveal hidden strings and data.
โข ๐๐๐จ๐๐๐ฎ๐ฌ๐๐๐ญ๐ข๐จ๐ง ๐ญ๐จ๐จ๐ฅ๐ฌ: Utilizing specialized software like De4dot to reverse engineer obfuscated code.
๐๐ญ๐๐ฒ ๐๐ฎ๐ง๐๐
The first article marks the introduction to a series. In upcoming installments, the authors will explore advanced obfuscation techniques used in real-world malware and strategies for extracting meaningful insights from obfuscated code.
Learn more in ANY.RUNโs blog post.
Veronika Trifonova
ANYRUN FZCO
+1 657-366-5050
email us here
Visit us on social media:
Twitter
YouTube
Legal Disclaimer:
EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.
