Custom Encoding

Malware often uses custom encoding schemes. It could be a full custom layer or a different layer of known algorithm (e.g: XOR+Base64).

U0702

Detection Rules

rule:
  meta:
    name: contain obfuscated stackstrings
    namespace: anti-analysis/obfuscation/string/stackstring
    author: moritz.raabe@fireeye.com
    scope: basic block
    att&ck:
      - Defense Evasion::Obfuscated Files or Information [T1027]
    mbc:
      - Anti-Static Analysis::Disassembler Evasion::Argument Obfuscation [B0012.001]
    examples:
      - Practical Malware Analysis Lab 16-03.exe_:0x4013D0
  features:
    - characteristic: stack string

Additional Resources

Subscribe to our Newsletter and don't miss important updates