Research: what methods of bypassing antiviruses are used by hackers

Creation of unique malware requires a lot of resources, so many hacker groups use massive, often publicly available malware in their attacks. Widespread use inevitably leads to the fact that such a tool gets on the radar of antivirus companies, and its effectiveness decreases.

To solve this problem, hackers use packaging, encryption and code mutation techniques. Such techniques are often implemented by separate tools - "crypters" or simply "packers". In this article, using the RTM banking Trojan as an example, we will look at what “packers” can be used by cybercriminals and how these “packers” complicate malware detection.

The full version of this study is available here .

---

Packer-as-a-service

The hacker group behind the distribution of RTM regularly carried out mass phishing emails with malicious attachments until the end of 2020. This process, apparently, took place automatically.

Each of these attachments contained significantly different files, while the final payload remained virtually unchanged.

— «». , RTM, «», 2020 .

- , . , , packer-as-a-service. , . .

Rex3Packer

RTM, , 2019 . , , — 2020 .

- , : (recursion), (reverse) PE- (reflection) — Rex3Packer.

:

1. VirtualAlloc , .

   
   
   
   
   

2. ( , .text).

   
   
   
   
   

3. .

   
   
   
   
   

4. PE- ( ). ebx. . , , PE- , .

   
   
   
   
   

5. .

   
   
   
   
   

6. VirtualProtect RWX PE-.

   
   
   
   
   

7. .

   
   
   
   
   

8. .

   
   
   
   
   

9. PE .

   
   
   
   
   

10. — PE-. PE-, .

    
    
    
    
    

. : , .

16 , 4 4 :

• ,

  
  
  
  
  

• (PE-),

  
  
  
  
  

• (*), ,

  
  
  
  
  

• (1, 2, 4).

  
  
  
  
  

:

1. ( , 10011000 00011001).

   
   
   
   
   

2. (1, 2, 4), N = 9, 5, 3 . — (N – 1) ( 8, 4, 2).

   
   
   
   
   

3. N-1 : . , 00000001, 00010001 01010101 . . OR , .

   
   
   
   
   

, 4 . .

4.  PE-, (*) . , , . (*) .

, :

• WinAPI. , , , .

  
  
  
  
  

• — ( ), .

  
  
  
  
  

• . , .

  
  
  
  
  

RTM, Rex3Packer , .

Nemty, Pony, Amadey.  

HellowinPacker

2020 RTM — HellowinPacker, 2021 . . , .

. . .

, Rex3Packer, HellowinPacker . , , . , , — .

, — HKEY_CLASSES_ROOT\Interface\{b196b287-bab4-101a-b69c-00aa00341d07} ( ) (Default). .

GUID .

, .

, (, ). VirtualAlloc RWX. X . Y .

4 :

• (DWORD),

  
  
  
  
  

• ,

  
  
  
  
  

• xor , Z.

  
  
  
  
  

Rex3Packer, HellowinPacker WinAPI, . . , .

WinAPI imphash.

: ( ). WinAPI, (, 0 ).

HellowinPacker 2014 . . :

, . , («») . . : .

, , . : . . , , (, PT Sandbox) . , . , — , PT Network Attack Discovery.

: