Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 897011" data-attributes="member: 32260">If I would like to hide the shellcode in the malware, then the best method would be to use a large portion of suspicious &amp; highly obfuscated &quot;dead&quot; code which does only innocent things. Some fragments could be the obfuscated bullshit which does not make any sense and might be executed only in the past (so it will not break anything now and in the future). It would be hard and time-consuming to find the right malicious code, especially when the malware does not trigger malicious actions in the VM or analyst&#039;s sandbox.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" />Another problem can be with targetted malware which uses some already known information about the targetted system to create a private decryption key. This key is created on the fly on any machine, but will successfully decrypt the malicious code only on the right machine.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite111" alt=":(" title="Frown&nbsp; &nbsp; :(" loading="lazy" data-shortname=":(" />All of the above and some other more sophisticated methods are known for years. The malc0ders rarely use them because much simpler methods still work.</blockquote>

[QUOTE="Andy Ful, post: 897011, member: 32260"] If I would like to hide the shellcode in the malware, then the best method would be to use a large portion of suspicious & highly obfuscated "dead" code which does only innocent things. Some fragments could be the obfuscated bullshit which does not make any sense and might be executed only in the past (so it will not break anything now and in the future). It would be hard and time-consuming to find the right malicious code, especially when the malware does not trigger malicious actions in the VM or analyst's sandbox.:unsure: Another problem can be with targetted malware which uses some already known information about the targetted system to create a private decryption key. This key is created on the fly on any machine, but will successfully decrypt the malicious code only on the right machine.:( All of the above and some other more sophisticated methods are known for years. The malc0ders rarely use them because much simpler methods still work. [/QUOTE]

Verification