malware used runonly avoid detection five

Malware used runonly avoid detection five windows#

We also show where VirusTotal focuses its detection efforts, by analysing EEE’s variants. VirusTotal’s tools learn and forget fast, actually in about 3 days.

We report both how well VirusTotal learns to detect EEE-packed binaries and how well VirusTotal forgets in order to reduce false positives. During our 6 month study, we continually improved EEE in response to VirusTotal, eventually learning a packer that produces packed malware whose evasiveness goes from an initial 51.8% median to 19.6%. We enter EEE into the detection arms race with VirusTotal, the most prominent cloud service for running anti-virus tools on software. Playing the role of a black hat, EEE uses evolutionary computation to disrupt the creation of malware signatures.

Malware used runonly avoid detection five windows#

To realise Hothouse, we evolve EEE, an entropy-based polymorphic packer for Windows executables. We present a method, called Hothouse, that combines simulation and search to accelerate the white hat’s ability to counter the black hat’s incremental moves, thereby forcing black hats to perform disruptive moves more often. Examples include system calls, signatures and machine learning. On occasion, white hats make a disruptive move and find a new technique that forces black hats to work harder. Most of the time, black hats need only make incremental changes to evade them.

White hats must be conservative to avoid false positives when searching for malicious behaviour. This arms race is asymmetric: detection is harder and more expensive than evasion. Malware detection is in a coevolutionary arms race where the attackers and defenders are constantly seeking advantage.