mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
ryan
1.8 KiB
1.8 KiB
| ID | B0008 |
| Objective(s) | Anti-Behavioral Analysis, Anti-Static Analysis |
| Related ATT&CK Techniques | None |
| Anti-Analysis Type | Evasion |
| Version | 2.0 |
| Created | 1 August 2019 |
| Last Modified | 31 October 2022 |
Executable Code Virtualization
Original executable code is virtualized by translating the code into a special format that only a special virtual machine (VM) can run; the VM uses a customized virtual instruction set. A "stub" function calls the VM when the code is run. Virtualized code makes static analysis and reverse engineering more difficult; dumped code won’t run without the VM.
Virtualized code is a software protection technique. Themida is a commercial tool; VMProtect is an open source tool. [1]
Methods
| Name | ID | Description |
|---|---|---|
| Multiple VMs | B0008.001 | Multiple virtual machines with different architectures (CISC, RISC, etc.) can be used inside of a single executable in order to make reverse engineering even more difficult. |
Use in Malware
| Name | Date | Description |
|---|---|---|
| Locky Bart | January 2017 | Code virtualization is added to the Locky Bart binary using WPProtect. [2] |
References
[1] https://github.com/xiaoweime/WProtect
[2] https://blog.malwarebytes.com/threat-analysis/2017/01/locky-bart-ransomware-and-backend-server-analysis/