Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Machine Learning Versus Memory Resident Evil

Summary: Unit 42 researchers describe a machine learning pipeline built on memory-based artifacts from their hypervisor-based sandbox in Advanced WildFire, designed to improve detection of malware that evades static analysis and sandboxing. They walk through a GuLoader sample encrypted with an NSIS crypter, unpacked using 7-Zip version 15.05, whose shellcode stages check for virtual machines and whose strings are XOR-encrypted, with the final payload being FormBook (SHA256 fa0b6404535c2b3953e2b571608729d15fb78435949037f13f05d1f5c1758173) downloaded from http://ozd[.]com[.]ar/wp-includes/nHMoYlbGLWls101.qxd.

Bottom line: The sample's first shellcode stage detects a virtual machine and stops, so a detection stack trained on execution logs alone would have seen nothing - the case for watching what malware does to process memory, such as flipping page permissions to writable and executable, rather than what it writes to disk.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related