Reply to thread

Message

<blockquote data-quote="cruelsister" data-source="post: 764647" data-attributes="member: 7463">Yes- I personally just love this approach. The two main ways such a delay can be implemented is either by a simple delay in execution (SleepEx [whatever time you want], or an API call (GetLocalTime)- commonly called a Time Trigger- where the malware will activate at some time in the future that the Blackhat will determine. It&#039;s a bit complicated but in essence will result in a permanent loop until the time specified would be achieved.An undocumented variant on this theme is one that Ophelia coded (I never would have thought of it being Kind and Gentle) that was used in my Boot Time Protection series a few years back. The malware would sleep until a certain action was taken (like a reboot), and only then would the payload be dropped and set to restart on system start. The drop would occur at at point too late for an AV to respond, and would start prior to all those AV&#039;s without boot time protection to prevent. Sharing this method with my nemesis Kaspersky (I&#039;m firm but fair) led to their inclusion of boot time protection for K products released after 2017.</blockquote>

[QUOTE="cruelsister, post: 764647, member: 7463"] Yes- I personally just love this approach. The two main ways such a delay can be implemented is either by a simple delay in execution (SleepEx [whatever time you want], or an API call (GetLocalTime)- commonly called a Time Trigger- where the malware will activate at some time in the future that the Blackhat will determine. It's a bit complicated but in essence will result in a permanent loop until the time specified would be achieved. An undocumented variant on this theme is one that Ophelia coded (I never would have thought of it being Kind and Gentle) that was used in my Boot Time Protection series a few years back. The malware would sleep until a certain action was taken (like a reboot), and only then would the payload be dropped and set to restart on system start. The drop would occur at at point too late for an AV to respond, and would start prior to all those AV's without boot time protection to prevent. Sharing this method with my nemesis Kaspersky (I'm firm but fair) led to their inclusion of boot time protection for K products released after 2017. [/QUOTE]

Verification