Press Center

ESET researchers bring unique obfuscation techniques to light, aiming to help the cybersecurity industry improve protection against sophisticated threats.

BRATISLAVA – ESET researchers have analyzed and described in detail several techniques used by malicious actors to thwart analysis and avoid detection of their malware. These custom obfuscation and detection evasion techniques were discovered in the course of the investigation of a new module used by the cybercriminals behind the Stantinko botnet.

“The protective techniques we encountered during our analysis are more advanced than the malware they protect. And some of them have not yet been publicly described,” commented Vladislav Hrčka, the ESET malware analyst who conducted the research.

Among the protective techniques, two stand out: the obfuscation of strings and control-flow obfuscation.

Obfuscation of strings relies on meaningful strings being constructed and only present in memory when they are to be used. Control-flow obfuscation transforms the control flow to a form that is hard to read, as the execution order of basic blocks is unpredictable without extensive analysis.

“We dissect these techniques and describe possible countermeasures against some of them,” added Hrčka.

In addition to obfuscation of strings and control-flow obfuscation, the malware authors also employed further techniques: dead code, do-nothing code, and dead strings and resources. These techniques are meant to prevent detection by making the files look more legitimate; furthermore, some implementations are aimed specifically to bypass behavioral detections.

For more details about the new module in the Stantinko botnet, read the blog post Stantinko’s new cryptominer features unique obfuscation techniques on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.