Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Defeating Guloader Anti-Analysis Technique

Summary: Unit 42 researchers found a Guloader (CloudEye) variant in early September 2022 with low VirusTotal detection, whose shellcode payload is protected by control flow obfuscation using 0xCC (int3) bytes followed by junk instructions to break static disassembly. The malware registers a vectored exception handler with AddVectoredExceptionHandler at order 1, performs anti-debugging checks that terminate execution on hardware or software breakpoints, and XOR-decodes the byte after each 0xCC with 0xA9 to compute the offset added to the instruction pointer.

Key Takeaway: The same 0xCC bytes that corrupt a disassembler's output also crash a debugger, so the standard analyst toolkit fails on this sample until the handler is reversed - and Unit 42 notes the technique carries over to families like Dridex, meaning the delay is not confined to one malware.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related