1

We have a malware that blocks all analytics software in real time.

This software has blacklisted a large list of software that performs analysis (x64dbg, ida, serialport monitor, etc.)

This software examines all items related to the software, including the following: package name,registry,driver

And if there is this softwares, it closes them and avoids re-running.

Developing proprietary software that they can not block is very time consuming and costly.

what's the solution?How can we do our analysis in this situation?

2
  • The solution may be very simple, but... We need to know more about your setup! 1. Which analytics software is being used, version etc give all information? 2. Is it stop only on that malware? 3. where is the malware? Send here so we can make a better answer 4. how is the malware come?
    – BadSugar
    Aug 28, 2021 at 11:50
  • We are not allowed to publish the software. When we debug, the malware detects what software is installed and what software is running, and if there is any analysis, monitoring and the like software, it stops immediately.
    – ILYA20
    Aug 28, 2021 at 12:10

1 Answer 1

1

Not much information has been disclosed about the program to be analyzed or its execution environment, so it is difficult to provide specific recommendations or solutions.

If you are in possession of the binary executable you want to analyze then total control over its behavior should be possible. There should also not be any need to develop a bespoke tool just to deal with the anti-analysis techniques implemented by the program.

There are a variety of techniques and strategies one can employ to force a program to behave as one desires and many different tools available that can be used to accomplish this. Some are listed below.

Static binary rewriting

Static binary rewriting is a means by which changes can be made to an executable file on disk, prior to execution. Perhaps some anti-debugging mechanisms can be patched such that they always return a value you desire? Frameworks that offer this capability include syzygy (Windows) and e9patch (Linux).

Syzygy examples:

e9patch examples:

System call interception

System call interception/hooking can grant significant control over process behavior at runtime without making any changes at all to the executable binary to be analyzed.

On Linux this can be achieved in a variety of ways, such as:

I'm not very familiar with windows, but Windows' DLL and kernel APIs strike me as more permissive than their Linux analogues. Here are some tools that may be of use for your analysis:

Dynamic Binary Instrumentation

Dynamic binary instrumentation is a method of changing process behavior by modifying its machine code at runtime. Tools such as Pin, Frida, QDBI and DynamoRIO provide this functionality.

Emulation

Emulation allows one to approximate process runtime behavior without directly executing it on the host. QEMU and Qiling are examples of emulators.

1
  • Thanks to your useful information, we are using Windows, we will soon perform the necessary tests on what you wrote and report the output.
    – ILYA20
    Sep 1, 2021 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.