9

I want to decrypt polymorphic malware and want to get actual virus body which is going to do infection. I tried to decrypt virut.ce (this is one polymorphic malware) in ollyDbg but it is using anti debugging and anti emulation technique and so it is very hard to find virus body.

I am able to get virus body of encrypted virus. But in case of polymorphic virus, decryption routine is morphed and hence it is difficult to obtain virus body.

Can anyone suggest me better approach to get virus body. Or can suggest other simple polymorphic malware which I can debug in OllyDbg. My goal is to get virus body from polymorphic malware.

  • If you have IVT enable PC (today's most PCs are) then you can get install Ether: Malware Analysis via Hardware Virtualization Extensions with Debia-lenny-5 The web also provides Unpacking Service. As I am aware only viruses made for research purpose can bypass Ether tool. I have used this tool in my research work. its awesome – Grijesh Chauhan Jul 7 '13 at 17:37
  • Did you tried this tool most of your crypt viruses can be decrypt. May I know what is your source of viruses?? – Grijesh Chauhan Jul 7 '13 at 17:40
  • Because your question is also related to Security you could post your question at IT-Security:tag:Malware – Grijesh Chauhan Jul 7 '13 at 17:49
  • I am taking polymorphic viruses from offensive computing . I took viruses like virut.ce, Bolzano. Now I am trying the tool you mentioned. But as you said only viruses made for research purpose can bypass Ether, I am not sure whether these viruses will be passed. Where can I see the viruses which are used for research purpose or which can pass ether ? – user1744108 Jul 7 '13 at 18:02
  • Ether is very good tool, it give you a dump for each entry point in host machine. Yes it bit hard to start work with it but it will pay back your time cost. By bypass my means some virus can detect even ether and prevent itself to decrypt. Some virus Danny Quist 's paper about this. -- My data set was consist of (1) real-viruses: licenced data(by a company), Some viruses I got from Mark Stamp sir (2) I also did tool analysis on synthetic viruses. Industry peoples know less about this tool – Grijesh Chauhan Jul 7 '13 at 19:00
5

Sounds like a fun challenge!

To get the malware body I'd recommend you use IDA Pro instead of Olly (but it is really your own choice). Anyway, first I'd recommend to trace what it does, do this by using a sandbox. Learn how malware detects this and think of a way around this detection mechanism. Read other papers and study how polymorphic and even metamorphic code works. I have always liked the metamorphism paper on OpenRCE http://www.openrce.org/articles/full_view/29

Getting there

In order to get this going I'd recommend writing a lot of unpacker plugins etc for IDA. See malware as unions. First analyse the first layer, build a plugin to automatically (staticly) unpack it (again IDA) and continue doing this till you get the entire thing to reverse. Remove the (bytepatch) anti-debug techniques and really get to know how this thing functions.

Basicly hard malware is a long tedious process that can not be automated. Making it really fun to analyse them. If you want quicker analyses you can look at TitaniumCore or submit the sample to a VirusExchange site like offensive computing :)

Have fun and goodluck!

  • Thanks for your inputs. Can you suggest which sandbox I can install and use. Because I searched for that and found some sandboxes like Anubis, threattrack. But there I can submit and can not see whats going on. – user1744108 Jul 9 '13 at 6:48
  • Well as you need to defeat the anti-emulation techniques in the malware. A 3th party solution is not acceptable as you can't tinker with it's internals. I'd recommend to do this either by hand or use open source software (Cuckoo box comes to mind as does ZeroWine). – Stolas Jul 9 '13 at 10:42
  • Great link, do you have the first one orr the author refer to? This paper is a direct descendent of my previous one... – 0x90 Jul 16 '13 at 15:51
  • openrce.org/articles/full_view/27 – Stolas Jul 17 '13 at 6:37
4

There isn't an easy way to extract the virus body from a polymorphic virus, because that's the nature of polymorphic malware. The more recent polymorphic malware also carry, as you see, anti-emulator and anti-debugger tricks.

If you want "easier" polymorphic malware, try some of the older ones, like Marburg, HPS, Magistr, Chiton (the "EfishNC" one, but the problem is to find the entrypoint), Bagif, Bounds (also has the tricky entrypoint problem - there's a good article about it, it's a linear decryptor but the first instruction that you see is not the first instruction of the decryptor), ... They can be emulated without issue. However, in the case of Marburg and HPS, the decryptors are very large (and in the case of Bounds, very large).

3

I would hesitate to categorically state that you cannot get the body of a polymorphic virus. It really does depend on the malware.

Here's an approach that will work in many cases where the malware is encrypted, packed, etc.

  1. Get the malware on a VM (or otherwise isolated box).
  2. Get the malware running.
  3. Dump the process memory using a tool like volatility or ProcDump (http://technet.microsoft.com/en-us/sysinternals/dd996900.aspx)

You will need to do some analysis to figure out precisely where the code entry point is in that memory dump but once you have it you will have a much easier time pulling it into something like IDA since the malware will most likely have already decrypted itself.

Of course, there are some techniques that involve just in time decryption/encryption while the malware is running, but these are more unusual to find. For -these- pieces of malware there is no quick and easy way to extract the decrypted body unless you have the algorithm and key already.

Hope this helps!

  • What if I debug malware manually in OllyDbg/IDAPro. Malware should decrypt itself at certain point of time right ? and form there I can take its body. Is it feasible idea ? – user1744108 Jul 13 '13 at 5:42
  • Yes and no. This is actually sort of close to what my answer is suggesting. The trouble is that a fair amount of malware includes anti-re beyond encryption, including techniques to detect or at least react to the presence of a debugger. This means that while your idea is a good one it will not work in all cases because the malware may not successfully decrypt itself under a debugger. This is why dumping the process is a more reliable approach though it is more difficult to then analyze the binary. – David Hoelzer Jul 13 '13 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.