Decrypted Code Execution

ID

decrypted_code_execution

Severity

critical

Resource

Execution

Tags

evader, trojan

Description

This detector looks for code that executes or evaluates code which has been previously decrypted.

Rationale

When code is encrypted, it means that it has been intentionally scrambled or obfuscated to make it difficult to understand or analyze.

While encryption itself is not inherently malicious, the execution of encrypted code can raise suspicions, especially in the context of malware analysis. Here are several reasons why executed code that was previously decrypted could be considered as potential evidence of malware:

  • Evasion of Detection: Malicious actors often use code encryption to evade detection by security software. Encryption can make it challenging for antivirus and other security tools to identify and analyze the code because the encrypted content looks like random data.

  • Payload Concealment: Malware creators may encrypt the payload of their malicious code to hide its true nature. By encrypting the malicious payload, they can prevent security researchers and automated systems from easily recognizing the harmful intent.

  • Dynamic Decryption: Some malware uses dynamic decryption techniques, where the actual malicious code is encrypted and only decrypted at runtime. This makes static analysis more difficult, as the code appears benign when not actively executing.

  • Stealth and Persistence: Encrypted code can be used to achieve stealth and persistence on a compromised system. Malware may encrypt its components to avoid detection during initial scans, allowing it to remain undetected for a longer period.

  • Anti-Reverse Engineering: Code encryption is a common technique employed to deter reverse engineering efforts. Malware authors may use encryption to make it more time-consuming and challenging for security researchers to understand and analyze the inner workings of the malicious code.

  • Command and Control Communication: Malware often communicates with its command and control servers to receive instructions or exfiltrate data. Encryption can be used to secure these communications, making it harder for network monitoring tools to detect malicious traffic.

  • Polymorphic Malware: Some malware variants use polymorphic techniques, where the code changes its appearance each time it runs, making it harder to detect using static signatures. Encryption can be part of these polymorphic strategies.

  • Obfuscation of Malicious Intent: Code encryption can be part of a broader strategy of obfuscation, where the true purpose and behavior of the code are hidden. This can make it challenging for analysts to determine the intent of the code without observing its behavior in a controlled environment.

Related Malware campaigns

This is a common feature that could be broadly found among malicious code. However, we can enumerate some popular variants using this technique:

  • 3CX Supply Chain Attack unfolded in March 2023 as a significant supply chain security breach. The assailants successfully infiltrated applications by incorporating a compromised library file, leading to the subsequent download of an encrypted file housing Command & Control information.

    The affected software executed a downloader, SUDDENICON, which received additional command and control (C2) servers from encrypted icon files on GitHub. The decrypted C2 server facilitated the download of a third stage, identified as ICONICSTEALER, a dataminer specializing in pilfering browser information.

  • PoisonIvy stands out as a widely utilized remote access tool (RAT) employed by various groups since its initial appearance in 2005.

  • Hydraq originated as a data-theft trojan first deployed by Elderwood during the 2009 Google intrusion, recognized as Operation Aurora. Numerous iterations of this trojan have since been utilized in more recent campaigns by different Chinese actors, potentially including APT17.

Configuration

The detector has the following configurable parameters:

  • sources, that indicates the source kinds to check. Available values are:

    • decrypted_input

  • sinks, that indicates the sink to check. Available values are:

    • command_injection

    • code_injection

  • neutralizations, that indicates the neutralization kinds to check. By default, this is empty. No neutralizers are considered for potential malicious code.

References