Malware Dynamic Analysis Evasion Techniques

Abstract

The Cyber world is plagued with ever-evolving malware that readily infiltrates all defense mechanisms, operates viciously unbeknownst to the user and surreptitiously exfiltrate sensitive data. Understanding the inner workings of such malware provides a leverage to effectively combat them. This understanding, is pursued through dynamic analysis which is conducted manually or automatically. Malware authors accordingly, have devised and advanced evasion techniques to thwart or evade these analyses. In this paper, we present a comprehensive survey on malware dynamic analysis evasion techniques. In addition, we propose a detailed classification of these techniques and further demonstrate how their efficacy hold against different types of detection and analysis approach.Our observations attest that evasive behavior is mostly interested in detecting and evading sandboxes. The primary tactic of such malware we argue, is fingerprinting followed by new trends for reverse Turing test tactic which aims at detecting human interaction. Furthermore, we will posit that the current defensive strategies beginning with reactive methods to endeavors for more transparent analysis systems, are readily foiled by zeroday fingerprinting techniques or other evasion tactics such as stalling. Accordingly, we would recommend pursuit of more generic defensive strategies with emphasis on path exploration techniques that has the potential to thwart all the evasive tactics.

Investigating Anti-Evasion Malware Triggers Using Automated Sandbox Reconfiguration Techniques

“…While seemingly trivial, these evasion techniques are increasingly used to determine whether the environment is a genuine target (i.e., a real system with a real user). Common evasion techniques may include system artefact checks, including the use of registry edits and virtual environment processes [2,4,[19][20][21][22][23][24][25][26], trigger-based behaviour [4,19,20,[26][27][28] and checks for human interaction [4,19,20,26,[29][30][31].…”

Investigating Anti-Evasion Malware Triggers Using Automated Sandbox Reconfiguration Techniques

“…Whilst seemingly trivial, these evasion techniques are increasingly used to determine whether the environment is a genuine target (i.e., a real system with a real user). Common evasion techniques may include system artefact checks, including the use of registry edits and virtual environment processes ( [2,4,[19][20][21][22][23][24][25][26]), trigger-based behaviour ( [4,19,20,[26][27][28]) and checks for human interaction ( [4,19,20,26,[29][30][31]).…”

Tight Arms Race: Overview of Current Malware Threats and Trends in Their Detection

“…In a very recent survey dealing with dynamic malware analysis [14], the authors focused on the techniques employed by malware to prevent the analysis and isolated the most common functionalities needed to implement a malicious behavior. In the survey [18], the authors noticed that evasive functionalities are primarily used to recognize and evade sandboxes; therefore, several works propose to use fingerprinting and the reverse Turing test for recognizing a genuine human interaction. Similar considerations can be found in an earlier survey [19].…”

“…• limited interest in information hiding: as shown, only one recent work dealt with information hiding (specifically, in the context of mobile devices). As modern mal- [23] x x x x x [16] x x x x x [24] x x [22] x x fileless [31] x adversarial ML [17] x tools [25] x AI [14] x x x evasion, tools [34] x x x evasion [18] x x evasion [21] x x APT [28] x x cybersecurity [19] x evasion [26] x x x x [27] x x cybersecurity [36] x x x visualisation [30] x x [11] x x behavior analysis, visualisation [12] x analysis [37] x x [33] x x x evasion [29] x x x [15] x x x x x [20] x x stealth malware [32] x x x C&C communication [35] x x x OS openness [38] x x [39] x visualisation ware is increasingly exploiting some form of steganography, information hiding and obfuscation to launch attacks or exfiltrate data [42], [43], this consolidated trend should be taken into account. • lack of sufficient coverage of new threats: despite the vivacity of the topic, many works continue to focus on the "legacy" hazards, e.g., phishing.…”