Dark.Netdark.Net
Dark.NetDark.Net gasgasgasgas 1 簡介簡介 MalwareMalware DotDot NetNet FrameworkFramework .net.net rootkitrootkit AntiAnti techtech QQ && AA 2 MalwareMalware 3 MalwareMalware VirusVirus BackdoorBackdoor TrojanTrojan horsehorse RootkitRootkit ScarewareScareware AdwareAdware WormWorm 4 InfectInfect ExecutableExecutable InterpretedInterpreted filefile KernelKernel ServiceService MBRMBR HypervisorHypervisor 5 HypervisorHypervisor rootkitrootkit AppApp AppApp TargetTarget OSOS HardwareHardware 6 HypervisorHypervisor rootkitrootkit AppApp AppApp RogueRogue appapp TargetTarget OSOS HostHost OSOS VirtualVirtual machinemachine monitormonitor HardwareHardware 7 MalwareMalware designdesign && techtech MetamorphismMetamorphism ObfuscationsObfuscations AntiAnti--emulationemulation AntiAnti--VirtualVirtual MachineMachine AntiAnti--debuggersdebuggers RootkitRootkit TechnologyTechnology 8 MetamorphismMetamorphism push ecx mov ecx, [ebp + 10] push ecx mov ecx, ebp mov ecx, ebp push eax push eax add eax, 2342 push ecx mov eax, 33 mov eax, 33 mov ecx,ebp add ecx, eax add ecx, eax push ecx mov [ebp - 3], eax add ecx,33 pop eax pop eax mov ecx,ebp push esi mov eax, esi add ecx,33 mov esi,ecx push esi push eax mov [ecx-36],eax sub esi,34 mov esi, ecx mov esi, ecx pop ecx mov [esi-2],eax push edx push edx pop esi xor edx, 778f pop ecx mov edx, 34 mov edx, 34 sub esi, edx sub esi, edx pop edx pop edx mov [esi - 2], eax mov [esi-2], eax pop esi pop esi pop ecx pop ecx 9 ObfsucationsObfsucations NORMAL CALL OBFUSCATED CALL L0a: push L1 L0b: push L5 L0: call L5 L0c: ret L1: … L1: … L2: … L2: … L3: … L3: … L4: … L4: … L5: <proc> L5: <proc> L6: … L6: … Call Obfsucations to prevent static analysis 10 AntiAnti--emulationemulation vsvs antianti--debugdebug AntiAnti--debugdebug • Hide the fact that someone with a debugger is stepping/monitoring your program • Focus in differences in system when a debugger is active vs not Memory structures Time usage (ticks) API behaviour Suspicious windows/drivers/services, e.g.
[Show full text]