What are the differences between metamorphic, oligomorphic and polymorphic malware?

Question

Malware use several methods to evade anti-virus software, one is to change their code when they are replicating. I saw mainly three type of techniques in the wild which are: metamorphic malware, oligomorphic malware and polymorphic malware (I might have missed one). What are the main differences between theses techniques and what do they do ?

Answer 1

In order of increasing complexity: oligomorphic, polymorphic, metamorphic.

The first two terms are generally applied to decryptors. We (anti-virus industry) define them this way: oligomorphic - decryptor with few variable elements, which does not affect the size or shape of the code. It means that the variable elements are usually fixed-size instructions, but it can also apply to the register initialization.

Oligomorphic example

std ;fake, might be replaced by cld / nop / xchg ax, cx / ...
mov cx, size
mov ax, ax ;fake, might be replaced by mov bx, bx / or cx, cx / ...
mov si, decrypt_src
cld ;fake
mov di, decrypt_dst
or ax, ax ;fake
mov bl, key
and bp, bp ;fake
decrypt:
xor [di], bl
xchg dx, ax ;fake
inc di
cld ;fake
loop decrypt

In this case, the di register could be exchanged with si, for example. Very simple replacement.

Polymorphic

decryptor with potentially highly variable elements, which does affect the size and/or shape of the code. It means that all kinds of changes can be applied, including subroutine creation, large blocks of garbage instructions, code "islands", or even algorithmic register initialisation (example here).

Metamorphic

highly variable elements are applied directly to the body. There is generally no decryptor in this case. The same techniques for polymorphism are applied to the code itself. The most famous example of this is the Simile virus from 2002 (details here). There's a detailed paper on the subject with actual examples here)

Answer 2

• polymorphic code (the generic term) different (different encryption key) code but same result

• oligomorphic code: pattern-based polymorphism

  • example:

  2 different executions of some oligomorphic code:

  MOV ECX,FC07379C    PUSH 40
  XOR ECX,FC0737DC    PUSH Tada
  PUSH ECX            NOP
  NOP                 PUSH Helloworld
  PUSH Tada           PUSH 0
  NOP                 NOP
  MOV ECX,F8477840    CALL MessageBoxA
  XOR ECX,F80779BC    MOV ECX,0A2EF248
  PUSH ECX            XOR ECX,0A2EF248
  NOP                 PUSH ECX
  PUSH 0              CALL ExitProcess
  CALL MessageBoxA
  PUSH 0
  PUSH 00400136
  PUSH ExitProcess
  CALL $ + 5
  RETN
  

• metamorphic code: polymorphism with auto-mutation - the result is slightly different