One tactic that needs to be used more often in #malware development is distributed multi-binary components.
Separate each of your components into unique binaries and communicate to them via IPC or something similar.
Each binary is given a single purposes: File IO, Registry etc
Separate each of your components into unique binaries and communicate to them via IPC or something similar.
Each binary is given a single purposes: File IO, Registry etc
There are several advantages to this:
Sandboxes will score each component separately and are more likely to not block a binary that just accesses the File System or registry because essentially it is harmless
Also components can use LOLBins if they are available as substitutes
Sandboxes will score each component separately and are more likely to not block a binary that just accesses the File System or registry because essentially it is harmless
Also components can use LOLBins if they are available as substitutes
Also you can recompiled the multi-components individually much easier than recompiling a whole project.
Also dont forget to write garbage to your padding sections / end of binary to easily change your file hashes.
Also dont forget to write garbage to your padding sections / end of binary to easily change your file hashes.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
