Skip to content

Malware Appendix

The material in this page is out of scope (not discussed in the course) but may be interesting.

Evasion

Examples

Slides:

Other examples:

  • Interesting Technique to Launch a Shellcode Basically, the CallWindowProc API function accepts any function pointer and blindly executes it, without creating any new thread. Many EDRs monitor CreateThread/NtCreateThreadEx but not this function (August 2025).
  • RealBlindingEDR Tool That Permanently Turns Off AV/EDR Using Kernel Callbacks (October 2025).
  • EDR-Freeze: A Tool That Puts EDRs And Antivirus Into A Coma State (September 2025)
  • Ransomware crews don't care about your endpoint security – they've already killed it. RealBlindingEDR is an open-source tool designed to disable endpoint detection and response products, and Crypto24's custom version is programmed to disable kernel-level hooks from a hardcoded list of 28 security vendors. These include Sophos, Trend Micro, Kaspersky, Malwarebytes, Bitdefender, Broadcom/Symantec, SentinelOne, Cisco, Fortinet, and Citrix. (August 2025)
  • Break The Protective Shell Of Windows Defender With The Folder Redirect Technique I will demonstrate the technique of breaking into the protected folder that contains the executable files of Windows Defender. From there, we can manipulate Defender at will, such as side-loading DLLs, destroying executable files to prevent the service from running, and more. (September 2025)
  • Silent Harvest: Extracting Windows Secrets Under the Radar I’ll share a new, simple approach I developed that successfully bypasses almost all EDRs I’ve tested...I’ll reveal the method I discovered to evade EDR detection and how it can enhance red team operations. In practice, calling RegQueryMultipleValuesW (even repeatedly against highly sensitive values in SAM or SECURITY) triggered zero alerts on every EDR platform I tested. My working hypothesis is that vendors concentrated on the far more common single-value APIs (RegQueryValueExW, NtQueryValueKey, etc.) and simply never added this rarer interface to their hook lists.(August 2025)
  • Using EDR-Redir To Break EDR Via Bind Link and Cloud Filter An attacker can execute various actions on the victim's EDR system to remain undetected: dropping DLL files for hijacking, placing executable files to trigger the EDR on their behalf, or simply blocking and disabling the processes and services of the EDR (October 2025).
  • TrueSightKiller: 2,500+ Weaponized Security Tool Variants Bypassing Microsoft's Defenses Threat actors are weaponizing a legitimate Windows security driver to execute a BYOVD (Bring Your Own Vulnerable Driver) attack, terminating EDR and antivirus protections before deploying malware. Over 2,500 validly signed TrueSight driver variants are actively bypassing Microsoft defenses (March 2026).
  • Corrupting the Hive Mind: Persistence Through Forgotten Windows Internals ...stealthy modification of the Windows Registry as a low privilege user. It’s been almost a year since we first deployed this technique in the wild, and given enough time has passed, it seems appropriate to share what we’ve learned...The fundamental issue is that EDR hooks into the standard Registry APIs...This creates an interesting challenge: how do you get registry persistence without actually touching the registry? (January 2026)

Credential managers in Browsers / Infostealers

Notes on Malware

Windows Executables

Windows executables are called PE files and their format conforms to PE/COFF (Portable Executables / Common Object File Format).

They start with bytes 4D 5A and consist of a series of structures containing the information required by the O.S. for loading the executable data in memory, including:

  • Content of code and data section;
  • Position in virtual memory where each section should be placed;
  • List of required libraries (Import table);
  • List of exported functions (Export table);
  • Address of entry point.

Several tools exist for analyzing an executable, i.e., for translating the PE information in human-readable way:

  • CFFExplorer, pestudio, PPEE, PE Internals, PEBrowse.

Static Analysis

File hashing

Computing hash values of files:

  • Linux md5sum, sha256sum, sha1sum
  • Windows HashMyFiles
  • Windows pestudio, PPEE also query VirusTotal by uploading only the hash.

File similarity

Methods for detecting files that are a "small variation" of each other (they will have entirely different hashes):

  • Fuzzy hashing is an efficient method for similarity comparison (files that differ only for a few bytes will be detected as highly similar). Tool: ssdeep.
  • Import hashing computes hashes based on the import tables. Malware samples developed by the same actor and compiled in the same way tend to have similar import tables. Tool: python pefile.
  • Section hashing computes hashes of each section separately. Tool: pestudio.

Extracting strings from executables

Strings stored in an executable can give clues about its functionality. If a malware creates a file (contacts a domain) then the filename (domain name) is likely stored in the executable.

It is useful to extract both ASCII strings and UNICODE strings.

  • Linux strings
  • Windows pestudio

Obfuscated strings can be extracted with FLOSS (FireEye Labs Obfuscated String Solver).

Malware Obfuscation

Obfuscation of an executable is not necessarily an indicator of malicious activity. In practice it is a very useful indicator, though.

Hints of obfuscation:

  • Executable with very few imports.
  • Uncommon section names.
  • Sections with virtual-size much greater than raw-size.

Main techniques:

  • Packer. The executable consists of an uncompressing routine (entry point) and of a compressed malware. The malware is reconstructed in memory at runtime.

    • UPX is a popular packer for Windows/Linux/MacOS.
    • ExeinfoPE is a packer detector for Windows, often able to unpack automatically. It uses thousands of signatures.
    • Cryptor. Like packing, except that the malware is encrypted.

Dynamic analysis

Monitoring of:

  • Process activity
  • File system
  • Registry
  • Network

Tools: Process Hacker, Process Monitor, Noriben (Python script that filters output of Process Monitor), Wireshark.

INetSim, FakeNet-NG emulate services for attempting to impersonate C&C servers.

  • Process Hacker Examine what is going on (processes and other o.s. activity)