![]() Another thing you will find in that post is the expression FUD (Fully Undetectable) which is the ultimate goal for malware authors. An in-depth analysis of one crypter (as an example) can be found in our blog post Malware Crypters – the Deceptive First Layer. Most crypters do not only encrypt the file, but the crypter software offers the user many other options to make the hidden executable as hard to detect by security vendors as possible The same is true for some packers. More complex methods use actual encryption. But most of the time these are not very hard to bypass or de-obfuscate. ![]() Obfuscation is also used often in scripts, like javascripts and vbscripts. A more elaborate blog post on that is Obfuscation: Malware’s best friend. The crudest technique for crypters is usually called obfuscation. In essence to make reverse engineering more difficult, with the added benefit of a smaller footprint on the infected machine. So when you see some packers being used nowadays, it is almost always for malicious purposes. But given the current size of portable media and internet speeds, the need for smaller files is not that urgent anymore. So users wouldn't have to unpack them manually before they could be executed. This type of compression was invented to make files smaller. Sometimes this technique is also called “executable compression”. Software that unpacks itself in memory when the “packed file” is executed. ![]() This usually is short for “runtime packers” which are also known as "self-extracting archives". So the goal is to hide the payload from the victim and from researchers that get their hands on the file. This is done by adding code that is not strictly malicious, but only intended to hide the malicious code. The payload, which is the actual malware that the threat actor wants to run on the victims’ computers, is protected against reverse engineering and detection (by security software). What they all have in common is their goal But this is the classification that makes sense to me. Bear in mind that no definitions for these categories are set in stone and that they all have overlap and that there are exceptions to the rules. In this article, we will try to explain the terms packer, crypter, and protector in the context of how they are used in malware.
0 Comments
Leave a Reply. |