Metamorphic Malware and Obfuscation: A Survey of Techniques, Variants, and Generation Kits

Abstract

The competing landscape between malware authors and security analysts is an ever-changing battlefield over who can innovate over the other. While security analysts are constantly updating their signatures of known malware, malware variants are changing their signature each time they infect a new host, leading to an endless game of cat and mouse. This survey looks at providing a thorough review of obfuscation and metamorphic techniques commonly used by malware authors. The main topics covered in this work are (1) to provide an overview of string-scanning techniques used by antivirus vendors and to explore the impact malware has had from a security and monetary perspective; (2) to provide an overview of the methods of obfuscation during disassembly, as well as methods of concealment using a combination of encryption and compression; (3) to provide a comprehensive list of the datasets we have available to us in malware research, including tools to obfuscate malware samples, and to finally (4) discuss the various ways Windows APIs are categorized and vectorized to identify malicious binaries, especially in the context of identifying obfuscated malware variants. This survey provides security practitioners a better understanding of the nature and makeup of the obfuscation employed by malware. It also provides a review of what are the main barriers to reverse-engineering malware for the purposes of uncovering their complexity and purpose.

A Survey on Hardware-Based Malware Detection Approaches

“…• Metamorphism: the binary sequence is altered by making a new malware version for each new infection through a mutation engine. The mutation engine uses code transforming and obfuscation to change the malicious code [22], [23], [30]. Several classes of software vulnerabilities can be explored to perform security attacks.…”

A Method for Detecting Ransomware Based on the Analysis of the Behavioral Report of the Executable Object

“…Статический анализ изучен хорошо и его эффективность достигает 99.4% [1]. Однако данный вид анализа неэффективен против сложных разновидностей вредоносных программ [2], которые используют методы шифрования [3], скрытия [4], упаковки [5] и полиморфных, олигоморфных и метаморфных преобразований [6]. Обнаружению при помощи динамического анализа уделено не так много внимания [7], хотя этот путь и выглядит более эффективным и более перспективным [8].…”

Enhanced detection of obfuscated malware in memory dumps: a machine learning approach for advanced cybersecurity

“…This type of malware, adept at camouflaging itself within regular computing operations, poses a significant threat to digital systems. Our research is centered on developing advanced methodologies to effectively identify and analyze these covert threats, specifically within memory dumps, where they are known to skillfully mask their activities (Asghar et al 2023;Bozkir et al 2021;Brezinski and Ferens 2023).…”