AntiRE en masse
Kurt Baumgartner PC Tools
download slides
From Autorun to Zbot, behavioural technologies ignore the most effective evasion strategies implemented in malware families'
packers and protection. However, proper research and analysis cannot ignore such capabilities. This paper will explore some
of the most effective and prevalent techniques, and compare antiRE across the most prevalent families of 2008 and the
first half of 2009.
Peter Ferrie has compiled an impressive list of antiRE techniques, but are they used and in the wild? Are they in
prevalence in 2009? If not, what is? Privileged instructions and mangled exception handlers, quirky stack modifications
with returns into thread creation routines in the windows loader, spaghetti flow jmp patterns, garbage api calls with
invalid parameters and a variety of methods will be fully analysed in depth. Waledac, Koobface, Sinowal, Taterf and Zbot
are just a few of the families that we will dissect and compare, and we will examine evasion data surrounding each of these
unfortunately effective implementations.
