mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Ryan Xu
1.5 KiB
1.5 KiB
| ID | B0005 |
| Objective(s) | Anti-Behavioral Analysis |
| Related ATT&CK Techniques | None |
| Version | 2.0 |
| Created | 1 August 2019 |
| Last Modified | 4 March 2023 |
Emulator Evasion
Behaviors that obstruct analysis in an emulator.
Methods
| Name | ID | Description |
|---|---|---|
| Different Opcode Sets | B0005.001 | Use different opcodes sets (ex: FPU, MMX, SSE) to block emulators. |
| Extra Loops/Time Locks | B0005.004 | Add extra loops to make time-constraint emulators give up. |
| Undocumented/Unimplemented Opcodes | B0005.002 | Use rare, undocumented, or unimplemented opcodes to block non-exhaustive emulators. |
| Unusual/Undocumented API Calls | B0005.003 | Call unusual APIs to block non-exhaustive emulators (particularly anti-virus). |
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| WebCobra | 2018 | B0005.004 | The malware evades emulator-based analysis by using an infinite loop to check all open windows and compare each window's title bar to a list of strings. [1] |
References
[1] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/