How to get virus body of Polymorphic Malware

Question

I want to decrypt polymorphic malware and want to get actual virus body which is going to do infection. I tried to decrypt virut.ce (this is one polymorphic malware) in ollyDbg but it is using anti debugging and anti emulation technique and so it is very hard to find virus body.

I am able to get virus body of encrypted virus. But in case of polymorphic virus, decryption routine is morphed and hence it is difficult to obtain virus body.

Can anyone suggest me better approach to get virus body. Or can suggest other simple polymorphic malware which I can debug in OllyDbg. My goal is to get virus body from polymorphic malware.

Answer 1

Sounds like a fun challenge!

To get the malware body I'd recommend you use IDA Pro instead of Olly (but it is really your own choice). Anyway, first I'd recommend to trace what it does, do this by using a sandbox. Learn how malware detects this and think of a way around this detection mechanism. Read other papers and study how polymorphic and even metamorphic code works. I have always liked the metamorphism paper on OpenRCE http://www.openrce.org/articles/full_view/29

Getting there

In order to get this going I'd recommend writing a lot of unpacker plugins etc for IDA. See malware as unions. First analyse the first layer, build a plugin to automatically (staticly) unpack it (again IDA) and continue doing this till you get the entire thing to reverse. Remove the (bytepatch) anti-debug techniques and really get to know how this thing functions.

Basicly hard malware is a long tedious process that can not be automated. Making it really fun to analyse them. If you want quicker analyses you can look at TitaniumCore or submit the sample to a VirusExchange site like offensive computing :)

Have fun and goodluck!

Answer 2

There isn't an easy way to extract the virus body from a polymorphic virus, because that's the nature of polymorphic malware. The more recent polymorphic malware also carry, as you see, anti-emulator and anti-debugger tricks.

If you want "easier" polymorphic malware, try some of the older ones, like Marburg, HPS, Magistr, Chiton (the "EfishNC" one, but the problem is to find the entrypoint), Bagif, Bounds (also has the tricky entrypoint problem - there's a good article about it, it's a linear decryptor but the first instruction that you see is not the first instruction of the decryptor), ... They can be emulated without issue. However, in the case of Marburg and HPS, the decryptors are very large (and in the case of Bounds, very large).

Answer 3

I would hesitate to categorically state that you cannot get the body of a polymorphic virus. It really does depend on the malware.

Here's an approach that will work in many cases where the malware is encrypted, packed, etc.

1. Get the malware on a VM (or otherwise isolated box).
2. Get the malware running.
3. Dump the process memory using a tool like volatility or ProcDump (http://technet.microsoft.com/en-us/sysinternals/dd996900.aspx)

You will need to do some analysis to figure out precisely where the code entry point is in that memory dump but once you have it you will have a much easier time pulling it into something like IDA since the malware will most likely have already decrypted itself.

Of course, there are some techniques that involve just in time decryption/encryption while the malware is running, but these are more unusual to find. For -these- pieces of malware there is no quick and easy way to extract the decrypted body unless you have the algorithm and key already.

Hope this helps!