Polymorphic Analysis

Information Security Asked by user109889 on November 23, 2021

I’m a beginner at malware analysis. For my research studies, I have to identify polymorphic malware based from experiments. I would like to know if there are any guides showing how to analyze the code (assembly language) of polymorphic malware using ollydbg (or other tools) to see where it started to mutate?

malware reverse engineering

One Answer

In the following articles, the decryption key of the decryption loop is mutated:

https://n1ps.wordpress.com/2008/09/14/w32virut-analysis/ https://n1ps.wordpress.com/2008/09/16/w32virut-analysis-part-2/

There's no universal guide to find all these kinds of mutations with OllyDbg or other tools but you could try to find Crypto code where there're lots of arithmetic/logic instructions as a tip to start your mutation digging journey.

Answered by Minh-Triet Pham Tran on November 23, 2021

Polymorphic Analysis

One Answer

Add your own answers!

Related Questions

What’s a “safe” URL shortening algorithm?

Examples of SSH key exchange algorithms requiring encryption-capable host keys

How can Google know that a Microsoft e-mail account is “not safe”?

Securing internet connection with hostile ISP

How to block all inbound traffic from a specific Internet address or subnet using TomatoUSB router software (LINUX based)

Is Chrome Browser/ Computer compromised by KMSPico?

Constant POST request spam to /cgi-bin/ViewLog.asp endpoint

Is it safe to allow www-data to execute privileged commands?

Web Cache Deception – exploitable without a cache server?

Determine if private key belongs to certificate?

PostgreSQL exploit not loading in MSFConsole from ExploitDB

Is splitting a REST API server from a Web server considered a security threat?

John The Ripper and PBKDF2-HMAC-SHA1

Filtering http responses for subdomain takeover

Sql map Manual Vulnerability Assessment

Unknown folders in OneDrive

Can I rely on the CSRF cookie to check if a user is authenticated on the client-side?

Quantify security strength from entropy and lifetime

Security risks from exposing ssh to a home server

Man In The Middle Attack On File Uploads

Ask a Question