mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00

Files

T

Ryan Xu 009ae77217 3.1 Updates (#145 )

* E/f updates (#143)

* E/F Update,  Update Install Cert ID

* Small fixes

* Update common objects link (#142)

* Update README.md

* Update 09152023.md

* Update README.md

* Update 12182023.md

* Adding descriptions to micro-behaviors

* Fixing dead links

* V3.1 updates (#144)

* minor fixes for v3.1

* correct id

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>

2024-02-14 09:27:20 -05:00

1.6 KiB

Raw Blame History

ID	B0029
Objective(s)	Defense Evasion
Related ATT&CK Techniques	None
Version	2.2
Created	1 August 2019
Last Modified	6 February 2024

Polymorphic Code

Polymorphic code, a file with the same functionality but different execution, is created, often on the fly, making it difficult to detect. This behavior includes metamorphic code where the code is changed (not just executed differently), but with the behavior the same. Polymorphic code behavior is typically identified through analysis of related samples.

Methods

Name	ID	Description
Call Indirections	B0029.002	[1]
Code Reordering	B0029.003	[1]
Packer Stub	B0029.001	A packer stub can generate polymorphic code.

Use in Malware

Name	Date	Method	Description
EvilBunny	2011	--	EvilBunny utilizes Lua scripts to exhibit polymorphism. [2]

Detection

Tool: CAPE	Mapping	APIs
polymorphic	Polymorphic Code (B0029)	--

References

[1] https://pages.cs.wisc.edu/~vrastogi/static/papers/rcj13b.pdf

[2] https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/

1.6 KiB Raw Blame History