Evasive Windows Malware: Impact on Antiviruses and Possible Countermeasures

Cédric Herzog, Valérie Tong, Pierre Wilke, Arnaud Van Straaten, Jean-Louis Lanet

2020

Abstract

The perpetual opposition between antiviruses and malware leads both parties to evolve continuously. On the one hand, antiviruses put in place solutions that are more and more sophisticated and propose more complex detection techniques in addition to the classic signature analysis. This sophistication leads antiviruses to leave more traces of their presence on the machine they protect. To remain undetected as long as possible, malware can avoid executing within such environments by hunting down the modifications left by the antiviruses. This paper aims at determining the possibilities for malware to detect the antiviruses and then evaluating the efficiency of these techniques on a panel of antiviruses that are the most used nowadays. We then collect samples showing this kind of behavior and propose to evaluate a countermeasure that creates false artifacts, thus forcing malware to evade.

Paper Citation

in Harvard Style

Herzog C., Tong V., Wilke P., Van Straaten A. and Lanet J. (2020). Evasive Windows Malware: Impact on Antiviruses and Possible Countermeasures.In Proceedings of the 17th International Joint Conference on e-Business and Telecommunications - Volume 3: SECRYPT, ISBN 978-989-758-446-6, pages 302-309. DOI: 10.5220/0009816703020309

in Bibtex Style

@conference{secrypt20,
author={Cédric Herzog and Valérie Tong and Pierre Wilke and Arnaud Van Straaten and Jean-Louis Lanet},
title={Evasive Windows Malware: Impact on Antiviruses and Possible Countermeasures},
booktitle={Proceedings of the 17th International Joint Conference on e-Business and Telecommunications - Volume 3: SECRYPT,},
year={2020},
pages={302-309},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0009816703020309},
isbn={978-989-758-446-6},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 17th International Joint Conference on e-Business and Telecommunications - Volume 3: SECRYPT,
TI - Evasive Windows Malware: Impact on Antiviruses and Possible Countermeasures
SN - 978-989-758-446-6
AU - Herzog C.
AU - Tong V.
AU - Wilke P.
AU - Van Straaten A.
AU - Lanet J.
PY - 2020
SP - 302
EP - 309
DO - 10.5220/0009816703020309