Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

There Is More Than One Way to Sleep: Dive Deep Into the Implementations of API Hammering by Various Malware Families

Summary: Unit 42 found Zloader and BazarLoader samples using new implementations of API Hammering, a sandbox evasion technique that makes large numbers of Windows API calls to delay execution of malicious routines. An older BazarLoader variant used a fixed 1,550 printf calls, while the newer one derives a random loop count and registry key list from a System32 file, and Zloader uses four large functions with nested calls to GetFileAttributesW, ReadFile, CreateFileW and WriteFile that generate more than a million function calls without a single large loop.

Bottom line: Zloader's four functions produce over a million API calls and BazarLoader's loop count shifts with each Windows version and patch set, so a sandbox that only waits out a fixed sleep window sees file I/O and registry reads that look like legitimate software.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related