Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Defeating Bazar Loader Anti-Analysis Techniques

Summary: Unit 42 researchers described two anti-analysis techniques in BazarLoader, a Windows backdoor used by various ransomware groups: API function hashing, which obfuscates which Windows functions are called, and opaque predicates, which obfuscate control flow. They published IDAPython scripts for IDA Pro that use the Appcall feature to resolve BazarLoader's unique API hashing at run time and that locate and patch opaque predicates, which they applied to a sample with the SHA-256 hash ce5ee2fd8aa4acda24baf6221b5de66220172da0eb312705936adc5b164cc052.

What's compelling: BazarLoader resolves every API function individually at run time and carries no Import Address Table, so detection that reads the IAT sees nothing; the same obfuscation is used across other malware families, which means the analysis cost lands on your incident responders.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related