I know that there are some obfuscation techniques which can lead to slowing or even failing the detection of malware when static analysis is used.
However, is there a similar technique that changes the order of the malware behaviour, which belongs to the same family or variants?
An example with Malware 1
and Malware 2
from the same malware family X
:
Malware 1
will connect to the internet and then access the registryMalware 2
will do the same thing but with a different order
If it does exist is their a known name for this kind of obfuscation? Are there any papers, which refer to such a obfuscation technique?