The Crimeware Arms Race: Modern Techniques in Malware Armoring & Evasion

The talk opens by separating two goals that malware authors pursue. Armoring is meant to frustrate the analyst studying the code itself, using packers, crypters, obfuscated Windows API calls, junk instructions and payloads that exist only in memory. Evasion is meant to keep malware dormant in analysis environments such as sandboxes and virtual machines, so that it runs only on the machines the author wants to reach.

The speakers then walk through evasion methods seen across the threat landscape. These include checks for virtualization artifacts, CPU core counts, system uptime, recent-document metadata and running analysis tools, along with long sleep periods, user-activity checks and macros that fire only when a document is closed. Network-side tactics are also covered, such as hiding command and control behind Tor back ends, geofencing by location, and tunneling C2 traffic through port-forwarding services. A case study of the Asteroth banking trojan, which targeted Brazilian financial institutions, ties these techniques together. Its late-stage DLL ran a long list of anti-analysis checks, forced a reboot if one failed, and looked up C2 domains hidden in YouTube channel descriptions.

For defenders, the takeaway is that sandboxes need hardening, and that anti-VM tools can reveal which artifacts a virtual machine exposes before it is used for analysis. Because some payloads never touch disk, detection has to look at memory and behavior as well as files, and it should be layered across several controls.