Introduction

In this post I explore several sandbox evasion techniques for malware. It’s part of my ongoing Malware Development series where I discover the world of malware development.

⚠️ Warning: This content is for educational and defensive security research purposes only. Do not use these techniques on systems or networks you do not own or have explicit permission to test.

Sandbox evasion

Previously, we implemented function obfuscation into the malware. Function obfuscation only protects against static analysis. Once the sample runs in a sandbox, a malware analyst can observe its real behavior and reverse engineer it. Sandbox evasion is one of the countermeasures for malware analysists. There are many ways for sandbox evasion. In the blog, we will be focusing on the following sandbox evasion techniques:

Introduction

In this post I explore several malware obfuscation techniques used to evade antivirus detection. It’s part of my ongoing Malware Development series where I discover the world of malware development.

⚠️ Warning: This content is for educational and defensive security research purposes only. Do not use these techniques on systems or networks you do not own or have explicit permission to test.

Windows applicatons

Windows application make use of dynamic-link libraries (DLL). These are libraries in Microsoft Windows that can contain code, functions, data and resources. The kernel32.dll is one of core DLL files in Windows. It handles core functions such as memory management, file input/output, and process/thread creation.

Introduction

In this post I explore several malware obfuscation techniques used to evade antivirus detection. It’s part of my ongoing Malware Development series where I discover the world of malware development.

⚠️ Warning: This content is for educational and defensive security research purposes only. Do not use these techniques on systems or networks you do not own or have explicit permission to test.

Antivirus detection

Antiviruses such as Bitdefender or Avast typically use a detection process, using multiple heuristic techniques to determine whether a piece of software has malicious characteristics: