Malware use several methods to evade anti-virus software, one is to change their code when they are replicating. I saw mainly three type of techniques in the wild which are: metamorphic malware, oligomorphic malware and polymorphic malware (I might have missed one). What are the main differences between theses techniques and what do they do ?

  • 2
  • 1
    Are you sure we can't do better than this (short) answer ? – perror Apr 10 '13 at 8:38
  • Still the difference between metamorphic and polymorphic are unclear to me... If someone can come with a better definition, I take it. – perror Feb 4 '14 at 17:32
up vote 7 down vote accepted

In order of increasing complexity: oligomorphic, polymorphic, metamorphic.

The first two terms are generally applied to decryptors. We (anti-virus industry) define them this way: oligomorphic - decryptor with few variable elements, which does not affect the size or shape of the code. It means that the variable elements are usually fixed-size instructions, but it can also apply to the register initialization.

Oligomorphic example

std ;fake, might be replaced by cld / nop / xchg ax, cx / ...
mov cx, size
mov ax, ax ;fake, might be replaced by mov bx, bx / or cx, cx / ...
mov si, decrypt_src
cld ;fake
mov di, decrypt_dst
or ax, ax ;fake
mov bl, key
and bp, bp ;fake
decrypt:
xor [di], bl
xchg dx, ax ;fake
inc di
cld ;fake
loop decrypt

In this case, the di register could be exchanged with si, for example. Very simple replacement.

Polymorphic

decryptor with potentially highly variable elements, which does affect the size and/or shape of the code. It means that all kinds of changes can be applied, including subroutine creation, large blocks of garbage instructions, code "islands", or even algorithmic register initialisation (example here).

Metamorphic

highly variable elements are applied directly to the body. There is generally no decryptor in this case. The same techniques for polymorphism are applied to the code itself. The most famous example of this is the Simile virus from 2002 (details here). There's a detailed paper on the subject with actual examples here)

  • polymorphic code (the generic term) different (different encryption key) code but same result
  • oligomorphic code: pattern-based polymorphism

    2 different executions of some oligomorphic code:

    MOV ECX,FC07379C    PUSH 40
    XOR ECX,FC0737DC    PUSH Tada
    PUSH ECX            NOP
    NOP                 PUSH Helloworld
    PUSH Tada           PUSH 0
    NOP                 NOP
    MOV ECX,F8477840    CALL MessageBoxA
    XOR ECX,F80779BC    MOV ECX,0A2EF248
    PUSH ECX            XOR ECX,0A2EF248
    NOP                 PUSH ECX
    PUSH 0              CALL ExitProcess
    CALL MessageBoxA
    PUSH 0
    PUSH 00400136
    PUSH ExitProcess
    CALL $ + 5
    RETN
    
  • metamorphic code: polymorphism with auto-mutation - the result is slightly different

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.