Malware Analysis Internals
[!WARNING]
DISCLAIMER: EDUCATIONAL & DEFENSIVE PURPOSES ONLY
This skill is strictly for analyzing and dissecting malicious software to write IOCs (Indicators of Compromise), YARA rules, and update EDR behavioral signatures.
1. Skill Context
Focus: Anti-analysis tricks, packers/crypters, API hooking, process injection, rootkit theory.
Triggers: anti-debugging techniques, unpack malware, api hooking internals, rootkit stealth
2. Deep Dissection Mechanics
The agent must explain how malware authors attempt to evade detection and how to defeat those evasions.
Anti-Debugging & Anti-VM
- Environment Checks: Malware querying
CPUID for hypervisor bits, checking for specific MAC addresses (OUI), or looking for VMware/VirtualBox specific drivers and registry keys.
- PEB (Process Environment Block): Manually traversing the PEB in assembly (e.g.,
mov eax, fs:[30h]) to check the BeingDebugged flag or the NtGlobalFlag, bypassing standard Windows API hooks on IsDebuggerPresent().
- Timing Attacks: Using
rdtsc (Read Time-Stamp Counter) to measure execution time. If execution takes too long, it assumes a human analyst is stepping through a debugger.
Packers & Unpacking Theory
- Mechanics: The true payload is compressed/encrypted and packed inside a "stub". Upon execution, the stub allocates memory (
VirtualAlloc), decrypts the payload into that memory, resolves necessary APIs, and jumps to the Original Entry Point (OEP).
- Defeating Packers: Setting hardware breakpoints (DR registers) on execution of the newly allocated memory regions, or dumping the process memory when
VirtualProtect changes the region to PAGE_EXECUTE_READ.
Rootkits & EDR Evasion
- Direct System Calls (Syswhispers): Bypassing user-land EDR API hooks (e.g., hooked
NtAllocateVirtualMemory in ntdll.dll) by manually pushing the syscall number into EAX and executing the syscall instruction directly, staying entirely under the radar of Ring-3 security tools.
- Kernel-Level Evasion (Ring 0): DKOM (Direct Kernel Object Manipulation). Unlinking a malicious process from the
EPROCESS active process links list, making it invisible to Task Manager and standard APIs while still receiving CPU cycles.
3. Output Format
- Provide the low-level API chains used by malware (e.g.,
CreateToolhelp32Snapshot -> Process32First -> OpenProcess).
- Explain how to bypass the anti-analysis trick (e.g., patching the binary, manipulating EFLAGS).
- Provide YARA rule concepts for the discussed behaviors.
1---2name: malware-analysis-internals3description: Malware Analysis Internals4---5# Malware Analysis Internals67> [!WARNING]8> **DISCLAIMER: EDUCATIONAL & DEFENSIVE PURPOSES ONLY**9> This skill is strictly for analyzing and dissecting malicious software to write IOCs (Indicators of Compromise), YARA rules, and update EDR behavioral signatures.1011## 1. Skill Context12**Focus**: Anti-analysis tricks, packers/crypters, API hooking, process injection, rootkit theory.13**Triggers**: anti-debugging techniques, unpack malware, api hooking internals, rootkit stealth1415## 2. Deep Dissection Mechanics16The agent must explain how malware authors attempt to evade detection and how to defeat those evasions.1718### Anti-Debugging & Anti-VM19- **Environment Checks**: Malware querying `CPUID` for hypervisor bits, checking for specific MAC addresses (OUI), or looking for VMware/VirtualBox specific drivers and registry keys.20- **PEB (Process Environment Block)**: Manually traversing the PEB in assembly (e.g., `mov eax, fs:[30h]`) to check the `BeingDebugged` flag or the `NtGlobalFlag`, bypassing standard Windows API hooks on `IsDebuggerPresent()`.21- **Timing Attacks**: Using `rdtsc` (Read Time-Stamp Counter) to measure execution time. If execution takes too long, it assumes a human analyst is stepping through a debugger.2223### Packers & Unpacking Theory24- **Mechanics**: The true payload is compressed/encrypted and packed inside a "stub". Upon execution, the stub allocates memory (`VirtualAlloc`), decrypts the payload into that memory, resolves necessary APIs, and jumps to the Original Entry Point (OEP).25- **Defeating Packers**: Setting hardware breakpoints (DR registers) on execution of the newly allocated memory regions, or dumping the process memory when `VirtualProtect` changes the region to `PAGE_EXECUTE_READ`.2627### Rootkits & EDR Evasion28- **Direct System Calls (Syswhispers)**: Bypassing user-land EDR API hooks (e.g., hooked `NtAllocateVirtualMemory` in `ntdll.dll`) by manually pushing the syscall number into `EAX` and executing the `syscall` instruction directly, staying entirely under the radar of Ring-3 security tools.29- **Kernel-Level Evasion (Ring 0)**: DKOM (Direct Kernel Object Manipulation). Unlinking a malicious process from the `EPROCESS` active process links list, making it invisible to Task Manager and standard APIs while still receiving CPU cycles.3031## 3. Output Format32- Provide the low-level API chains used by malware (e.g., `CreateToolhelp32Snapshot` -> `Process32First` -> `OpenProcess`).33- Explain how to bypass the anti-analysis trick (e.g., patching the binary, manipulating EFLAGS).34- Provide YARA rule concepts for the discussed behaviors.
j4flmao