Malware use several methods to evade anti-virus software, one is to change their code when they are replicating. I saw mainly three type of techniques in the wild which are: metamorphic malware, oligomorphic malware and polymorphic malware (I might have missed one). What are the main differences between theses techniques and what do they do ?
In order of increasing complexity: oligomorphic, polymorphic, metamorphic.
The first two terms are generally applied to decryptors. We (anti-virus industry) define them this way: oligomorphic - decryptor with few variable elements, which does not affect the size or shape of the code. It means that the variable elements are usually fixed-size instructions, but it can also apply to the register initialization.
std ;fake, might be replaced by cld / nop / xchg ax, cx / ... mov cx, size mov ax, ax ;fake, might be replaced by mov bx, bx / or cx, cx / ... mov si, decrypt_src cld ;fake mov di, decrypt_dst or ax, ax ;fake mov bl, key and bp, bp ;fake decrypt: xor [di], bl xchg dx, ax ;fake inc di cld ;fake loop decrypt
In this case, the
di register could be exchanged with
si, for example. Very simple replacement.
decryptor with potentially highly variable elements, which does affect the size and/or shape of the code. It means that all kinds of changes can be applied, including subroutine creation, large blocks of garbage instructions, code "islands", or even algorithmic register initialisation (example here).
highly variable elements are applied directly to the body. There is generally no decryptor in this case. The same techniques for polymorphism are applied to the code itself. The most famous example of this is the Simile virus from 2002 (details here). There's a detailed paper on the subject with actual examples here)
- polymorphic code (the generic term) different (different encryption key) code but same result
oligomorphic code: pattern-based polymorphism
2 different executions of some oligomorphic code:
MOV ECX,FC07379C PUSH 40 XOR ECX,FC0737DC PUSH Tada PUSH ECX NOP NOP PUSH Helloworld PUSH Tada PUSH 0 NOP NOP MOV ECX,F8477840 CALL MessageBoxA XOR ECX,F80779BC MOV ECX,0A2EF248 PUSH ECX XOR ECX,0A2EF248 NOP PUSH ECX PUSH 0 CALL ExitProcess CALL MessageBoxA PUSH 0 PUSH 00400136 PUSH ExitProcess CALL $ + 5 RETN
- metamorphic code: polymorphism with auto-mutation - the result is slightly different