Abstract
Malware authors constantly develop new techniques in order to evade analysis systems. Previous works addressed attempts to evade analysis by means of anti-sandboxing and anti-virtualization techniques, for example proposing to run samples on bare-metal. However, state-of-the-art bare-metal tools fail to provide richness and completeness in the results of the analysis. In this context, Dynamic Binary Instrumentation (DBI) tools have become popular in the analysis of new malware samples because of the deep control they guarantee over the instrumented binary. As a consequence, malware authors developed new techniques, called anti-instrumentation, aimed at detecting if a sample is being instrumented. We propose a practical approach to make DBI frameworks more stealthy and resilient against anti-instrumentation attacks. We studied the common techniques used by malware to detect the presence of a DBI tool, and we proposed a set of countermeasures to address them. We implemented our approach in Arancino, on top of the Intel Pin framework. Armed with it, we perform the first large-scale measurement of the anti-instrumentation techniques employed by modern malware. Finally, we leveraged our tool to implement a generic unpacker, showing some case studies of the anti-instrumentation techniques used by known packers.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
References
Exeinfo PE. http://exeinfo.atwebpages.com/
Obsidium. https://www.obsidium.de/show/download/en
PESpin. http://www.pespin.com/
Aaraj, N., Raghunathan, A., Jha, N.K.: Dynamic binary instrumentation-based framework for malware defense. In: Proceeding of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA) (2008)
Arne, S., Alaeddine, M.: One packer to rule them all: Empirical identification, comparison and circumvention of current Antivirus detection techniques. https://www.blackhat.com/docs/us-14/materials/us-14-Mesbahi-One-Packer-To-Rule-Them-All-WP.pdf
Arora, R., Singh, A., Pareek, H., Edara, U.R.: A heuristics-based static analysis approach for detecting packed PE binaries. Int. J. Secur. Appl. 7(5), 257–268 (2013)
Bania, P.: Generic unpacking of self-modifying, aggressive, packed binary programs. arXiv preprint arXiv:0905.4581 (2009)
BromiumLabs. The Packer Attacker is a generic hidden code extractor for Windows malware. https://github.com/BromiumLabs/PackerAttacker
Bruening, D., Duesterwald, E., Amarasinghe, S.: Design and implementation of a dynamic optimization framework for windows. In: ACM Workshop on Feedback-Directed and Dynamic Optimization (FDDO-4) (2001)
Brumley, D., Hartwig, C., Liang, Z., Newsome, J., Poosankam, P., Song, D., Yin, H.: Automatically identifying trigger-based behavior in malware. In: Botnet Detection (2008)
Caballero, J., Johnson, N.M., McCamant, S., Song, D.: Binary code extraction and interface identification for security applications. Technical report, DTIC Document (2009)
Continella, A., Guagnelli, A., Zingaro, G., De Pasquale, G., Barenghi, A., Zanero, S., Maggi, F.: Shieldfs: a self-healing, ransomware-aware filesystem. In: Proceeding of the Annual Conference on Computer Security Applications (ACSAC) (2016)
Coogan, K., Debray, S., Kaochar, T., Townsend, G.: Automatic static unpacking of malware binaries. In: Proceeding of Working Conference on Reverse Engineering (WCRE). IEEE (2009)
Deng, Z., Zhang, X., Spider, D.: Stealthy binary program instrumentation and debugging via hardware virtualization. In: Proceeding of the Annual Computer Security Applications Conference (ACSAC) (2013)
Falcon, F., Riva, N.: Dynamic binary instrumentation frameworks: i know you’re there spying on me. In: Proceeding of Reverse Engineering Conference (2012)
Gröbert, F., Willems, C., Holz, T.: Automated identification of cryptographic primitives in binary programs. In: Sommer, R., Balzarotti, D., Maier, G. (eds.) RAID 2011. LNCS, vol. 6961, pp. 41–60. Springer, Heidelberg (2011). doi:10.1007/978-3-642-23644-0_3
Guo, F., Ferrie, P., Chiueh, T.-C.: A study of the packer problem and its solutions. In: Proceeding of International Workshop on Recent Advances in Intrusion Detection (RAID) (2008)
Hex-Rays. IDA Universal Unpacker. https://www.hex-rays.com/products/ida/support/tutorials/unpack_pe/index.shtml
Kang, M.G., Poosankam, P., Yin, H.: Renovo: a hidden code extractor for packed executables (2007)
Kirat, D., Vigna, G., Kruegel, C.: Barebox: efficient malware analysis on bare-metal. In: Proceeding of the Annual Computer Security Applications Conference (ACSAC). ACM (2011)
Kirat, D., Vigna, G., Kruegel, C.: BareCloud: bare-metal analysis-based evasive malware detection. In: Proceeding of USENIX Security (2014)
Lenoir, J.: Implementing Your Own Generic Unpacker (2015)
Luk, C.-K., Cohn, R., Muth, R., Patil, H., Klauser, A., Lowney, G., Wallace, S., Reddi, V.J., Hazelwood, K.: Pin: building customized program analysis tools with dynamic instrumentation. In: ACM Sigplan Notices. ACM (2005)
Lyda, R., Hamrock, J.: Using entropy analysis to find encrypted and packed malware. In: Proceeding of IEEE symposium on Security and Privacy (SP). IEEE (2007)
Martignoni, L., Christodorescu, M., Jha, S.: OmniUnpack: fast, generic, and safe unpacking of malware. In: Proceeding of the Annual Computer Security Applications Conference (ACSAC). IEEE (2007)
Ming, J., Wu, D., Xiao, G., Wang, J., Liu, P.: TaintPipe: pipelined symbolic taint analysis. In: Proceeding of USENIX Security (2015)
Ming, J., Xu, D., Wang, L., Wu, D.: Loop: logic-oriented opaque predicate detection in obfuscated binary code. In: Proceeding of the ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM (2015)
Moser, A., Kruegel, C., Kirda, E.: Exploring multiple execution paths for malware analysis. In: Proceeding of IEEE symposium on Security and Privacy (SP) (2007)
Nethercote, N., Seward, J.: Valgrind: a program supervision framework. Electron. Notes Theor. Comput. Sci. 89(2), 44–66 (2003)
Polino, M., Scorti, A., Maggi, F., Zanero, S.: Jackdaw: towards automatic reverse engineering of large datasets of binaries. In: Proceeding of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA) (2015)
Quist, D.: Circumventing software armoring techniques. https://www.blackhat.com/presentations/bh-usa-07/Quist_and_Valsmith/Presentation/bh-usa-07-quist_and_valsmith.pdf
Rossow, C., Dietrich, C.J., Grier, C., Kreibich, C., Paxson, V., Pohlmann, N., Bos, H., Van Steen, M.: Prudent practices for designing malware experiments: status quo and outlook. In: Proceeding of IEEE symposium on Security and Privacy (SP) (2012)
Royal, P., Halpin, M., Dagon, D., Edmonds, R., Lee, W.: PolyUnpack: automating the hidden-code extraction of unpack-executing malware (2006)
Sebastián, M., Rivera, R., Kotzias, P., Caballero, J.: AVclass: a tool for massive malware labeling. In: Monrose, F., Dacier, M., Blanc, G., Garcia-Alfaro, J. (eds.) RAID 2016. LNCS, vol. 9854, pp. 230–253. Springer, Cham (2016). doi:10.1007/978-3-319-45719-2_11
Sharif, M., Yegneswaran, V., Saidi, H., Porras, P., Lee, W.: Eureka: a framework for enabling static malware analysis. In: Jajodia, S., Lopez, J. (eds.) ESORICS 2008. LNCS, vol. 5283, pp. 481–500. Springer, Heidelberg (2008). doi:10.1007/978-3-540-88313-5_31
Sikorski, M., Honig, A.: Practical Malware Analysis. No Starch Press, San Francisco (2012)
Spensky, C., Hu, H., Leach, K.: LO-PHI: low observable physical host instrumentation. In: Proceeding of the Network and Distributed System Security Symposium (NDSS) (2016)
Ugarte-Pedrero, X., Balzarotti, D., Santos, I., Bringas, P.G. SoK: deep packer inspection: a longitudinal study of the complexity of run-time packers. In: Proceeding of IEEE symposium on Security and Privacy (SP). IEEE (2015)
Ugarte-Pedrero, X., Balzarotti, D., Santos, I., Bringas, P.G.: RAMBO: run-time packer analysis with multiple branch observation. In: Caballero, J., Zurutuza, U., Rodríguez, R.J. (eds.) DIMVA 2016. LNCS, vol. 9721, pp. 186–206. Springer, Cham (2016). doi:10.1007/978-3-319-40667-1_10
Vasudevan, A., Yerraballi, R.: Stealth breakpoints. In: Proceeding of the Annual Computer Security Applications Conference (ACSAC). IEEE (2005)
Vasudevan, A., Yerraballi, R.: Spike: engineering malware analysis tools using unobtrusive binary-instrumentation. In: Proceeding of the 29th Australasian Computer Science Conference, vol. 48. Australian Computer Society Inc. (2006)
Wilhelm, J., Chiueh, T.: A forced sampled execution approach to kernel rootkit identification. In: Kruegel, C., Lippmann, R., Clark, A. (eds.) RAID 2007. LNCS, vol. 4637, pp. 219–235. Springer, Heidelberg (2007). doi:10.1007/978-3-540-74320-0_12
Yadegari, B., Johannesmeyer, B., Whitely, B., Debray, S.: A generic approach to automatic deobfuscation of executable code. In: Proceeding of IEEE symposium on Security and Privacy (SP). IEEE (2015)
Yu, S.-C., Li, Y.-C.: A unpacking and reconstruction system-agunpacker. In: Proceeding of International Symposium on Computer Network and Multimedia Technology, (CNMT). IEEE (2009)
Acknowledgements
We would like to thank our reviewers and our shepherd Alexandros Kapravelos for their valuable comments and input to improve our paper. We would also like to thank Alessandro Frossi for his insightful feedback and VirusTotal for providing us access to malware samples. This work was supported in part by the MIUR FACE Project No. RBFR13AJFT. This project has also received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 700326.
Author information
Authors and Affiliations
Corresponding authors
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2017 Springer International Publishing AG
About this paper
Cite this paper
Polino, M. et al. (2017). Measuring and Defeating Anti-Instrumentation-Equipped Malware. In: Polychronakis, M., Meier, M. (eds) Detection of Intrusions and Malware, and Vulnerability Assessment. DIMVA 2017. Lecture Notes in Computer Science(), vol 10327. Springer, Cham. https://doi.org/10.1007/978-3-319-60876-1_4
Download citation
DOI: https://doi.org/10.1007/978-3-319-60876-1_4
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-60875-4
Online ISBN: 978-3-319-60876-1
eBook Packages: Computer ScienceComputer Science (R0)