AntiRE en masse

Kurt Baumgartner PC Tools

  download slides

From Autorun to Zbot, behavioural technologies ignore the most effective evasion strategies implemented in malware families' packers and protection. However, proper research and analysis cannot ignore such capabilities. This paper will explore some of the most effective and prevalent techniques, and compare antiRE across the most prevalent families of 2008 and the first half of 2009.

Peter Ferrie has compiled an impressive list of antiRE techniques, but are they used and in the wild? Are they in prevalence in 2009? If not, what is? Privileged instructions and mangled exception handlers, quirky stack modifications with returns into thread creation routines in the windows loader, spaghetti flow jmp patterns, garbage api calls with invalid parameters and a variety of methods will be fully analysed in depth. Waledac, Koobface, Sinowal, Taterf and Zbot are just a few of the families that we will dissect and compare, and we will examine evasion data surrounding each of these unfortunately effective implementations.


We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.