Explore a 20-minute Black Hat conference talk on BluePill, a tool designed to neutralize anti-analysis behavior in malware dissection. Discover how this customizable solution allows analysts to add hooks and leverage insights from dissection, making it particularly effective against targeted malware and new evasion techniques. Learn how BluePill overcomes semantic gaps and successfully defeats tricks employed by recent evasive samples and executable protectors. Gain insights into performing malware analysis on a standard VirtualBox installation alongside traditional analysis tools. The presentation covers dynamic analysis, DBI evasion, manual vs. automatic approaches, results, and future developments in this field.
BluePill - Neutralizing Anti-Analysis Behavior in Malware Dissection
Overview
Syllabus
Introduction
Dynamic Analysis
DBI Evasion
Manual vs Automatic
Results
Next steps
Taught by
Black Hat
Related Courses
-
Reverse Engineering 102
-
Malware Analysis and Introduction to Assembly Language
-
Full System Emulation - Achieving Successful Automated Dynamic Analysis of Evasive Malware
-
Hiding PIN's Artifacts to Defeat Evasive Malware
-
Pindemonium - A DBI-Based Generic Unpacker for Windows Executable
-
Catch Me If You Can - A Decade of Evasive Malware Attack and Defense
