Bypassing Anti Analysis Techniques

[Jarvis]

@kingler

How does malware actually run differently under analysis? I.e. does the binary actually change or does it just take a different branch of execution when running?

What’s the difference between normal Execution and a binary “under analysis” ?

One has a debugger attached to it, the other doesnt

One (Windows-)function being isDebuggerPresent.

 if(IsDebuggerPresent())
 {
   TerminateProcess(GetCurrentProcess(), 1);
 }

IsDebuggerPresent reads the BeingDebugged byte from the PEB, so that could be another check.

These are just 2 possible checks that happen on Windows, there’s a lot more, and you can find some pretty good resources here too.

Like this one for example.

@kingler

What can I do to make it behave normally under analysis?

Well, it “knows” you attached a debugger, so you’re gonna have to tell it there’s no debugger there!
Lucky for you, a lot of debuggers have scripts to auto-hide your debugger against a lot of different features.

One such plugin, is ScyllaHide.

@kingler

Do Malware authors write these anti analysis techniques into the malware themself or is there a tool to optimize the code?

Well, I suppose a lot of people just copy pasta SO code, also, implementing something like “IsdebuggerPresent” is not that hard as you can see above.

Of course, the amount of effort you put into obfuscation and anti-debugging / anti-vm / … will result in higher effort on the other side (to reverse it back).

I’m not aware of any tools that automatically implement advanced anti-debugging, but this is of course without consideration of packers and crypters.