The rapidly evolving landscape of malware has led to the development of increasingly sophisticated threats that defy traditional analysis methods. Take GuLoader, a shellcode-based downloader notorious for its high malware execution success rate, as a case in point. With advanced anti-debugging, sandbox evasion, and code obfuscation techniques, GuLoader highlights the urgent need for adapting cybersecurity measures. From storing encrypted shellcode on Google Drive to employing vector exception handlers, this downloader represents cutting-edge tactics, rendering conventional anti-malware strategies obsolete. Intrigued? Keep reading to dive into the technical details of how GuLoader evades detection and what it signifies for the future of malware analysis.

Traditionally, we are taught how to analyze malware by following these steps :

Well, there is malware that can evade all these features gracefully because the people making them are working hard at its constant development and improvement. There is one shellcode-based downloader called GuLoader. It is extremely good at its job as it uses anti-debugging and sandbox evasion techniques, which we will investigate later. This downloader acts as a vehicle for payload (malware) delivery. The fact that it is so good at evading detection helps the malware execution success rate skyrocket!

It uses Google Drive to store its encrypted shellcode and download on demand.

The shellcode is very good at evading the Sandbox by :

  1. checking for strings related to VM like ‘VirtualBox’ or ‘VMware’
  2. Via CPUID Instruction, setting EAX to 1 and executing the CPUID instruction checks the 31st bit in ECX. If that bit is set, it indicates the program is running in a hypervisor.
  3. Using the EnumDeviceDrivers API function to check for VM-related drivers.
  4. Using MsiEnumProductsA and MsiGetProductInfoA to list installed software and identify if any are related to virtual machines.

Now for anti-debugging techniques used are :

  1. Hooking the functions DbgBreakPoint and DbgUiRemoteBreakIn involves modifying these functions to behave differently than intended. This can prevent a debugger from successfully attaching to the process. By altering these functions, the software can make it difficult for security analysts to analyze it using debugging tools.
  2. The method uses the NtSetInformationThread function with the ThreadHideFromDebugger parameter. This makes the program’s main thread invisible to a debugger, making it harder for analysts to debug and understand what the program is doing. The thread then goes about doing its

Another ingenious technique it uses is to prevent/make challenging analyses by using a vector exception handler that transfers control to a dynamic address.

Code Obfuscation is also very much implemented these days. That, too, has a lot of ways to be done like:

  1. Compresses the malware code, which is then unpacked during runtime.
  2. Encrypts portions of the code, which are decrypted only when needed.
  3. Inserts irrelevant instructions to mislead analysts.
  4. Makes the execution flow nonlinear and confusing.
  5. Encodes strings used in the code to make static analysis difficult.
  6. Uses indirect calls to system functions to make behaviour tracking complex.

Multiple layers of encryption are done to make it challenging for AVs.

At its core, a payload is the part of the malware that performs the malicious action, while the loader is responsible for executing that payload. Now, storing the payload without its headers helps hide the malicious intentions. Keeping a malware payload in raw binary format without recognizable file headers makes it difficult for traditional antivirus programs to identify it based on known malware signatures. When the payload is kept separate from the loader, even if antivirus software detects the loader, the payload itself may go unnoticed. This separation allows for the payload to be executed later, further evading detection measures.

GuLoader showcases the limitations of traditional cybersecurity methods like sandboxing and reverse engineering, using advanced evasion techniques such as anti-debugging and code obfuscation. Its ability to store encrypted shellcode on Google Drive and separate its payload from the loader further complicates detection. These developments signal an urgent need for the cybersecurity industry to evolve, as conventional anti-malware strategies are increasingly ineffective against such sophisticated threats.