Defeating APT10 Compiler-level Obfuscation

Explore advanced techniques for defeating compiler-level obfuscations used by APT10 in this 29-minute conference talk from Recon 2019. Dive into the challenges posed by opaque predicates and control flow flattening in malware analysis, focusing on the ANEL (UpperCut) RAT targeting Japan. Learn how to automatically de-obfuscate ANEL code by modifying the IDA Pro plugin HexRaysDeob. Gain insights into disassembler tool internals, methods for defining and tracking opaque predicate patterns, and strategies for breaking control flow flattening. Discover the implementation details of a publicly available tool that can de-obfuscate approximately 89% of encountered functions in tested samples. Equip yourself with valuable knowledge to combat these obfuscation techniques, which may be adopted by other threat actors in the future.