Full System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
summary
Argues that full system emulation—CPU- and hardware-level emulation running a real Windows guest—combines visibility and fidelity to defeat common sandbox evasions; describes Anubis and Lastline engines, per-instruction data flow tracking, constraint solving to invert input checks (e.g., derive X=23 so a compare yields 47), and memory snapshots to export unpacked code to IDA. Shows concrete evasion samples: anti‑Anubis checks, VM fingerprints, DLL‑unload race, sleep/stall loops and hook bypasses, and demonstrates automated path exploration and loop-detection/acceleration that successfully exposes hidden behavior.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:29What are we talking about?
- 3:24Evolution of Malware
- 8:10What do we want to monitor?
- 16:53VM Approach versus CPU Emulation
- 17:19Dynamic Analysis Approaches
- 17:47Our Automated Malware Analysis
- 18:13Visibility Does Matter
- 21:00Detecting Keyloggers
- 21:50Supporting Static Analysis
- 25:35Detect Runtime Environment
- 28:47Detect Analysis Engine
- 31:12Avoid Monitoring
- 38:01What can we do about evasion?
- 39:55Bypassing Triggers
- 46:22Combating Evasion
- 47:43Passive Mode
- 47:58Active Mode
- 48:30Evasion in a Broader Context
- 49:59Conclusions
related talks
45m"Advanced Malware Threat: handling obfuscated code using..."
31mBypassing Anti-Debugging: A Hybrid Real-Simulated Approach to Rootkit Analysis
41mAPTs Way: Evading Your EBNIDS
01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized Packers
33mProactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware
37mDynamic Image Scanning Through System Tracing
44mSlime: Automated Anti-Sandboxing Disarmament System
28mAVLeak: Fingerprinting Antivirus Emulators for Advanced Malware Evasion