Python Malware Starting to Employ Anti-Debug Techniques

Re:Python Malware Starting to Employ Anti-Debug Techniques by hybridtupel on Friday December 23, 2022 @08:46AM (#34105719)

> Malware that is more stealth-conscious would just stop running without any indication, instead of interacting with external processes.

I always wondered if we could just use this against the malware. E.g. just run a useless process which is named/looks like a debugger and the malware stops itself. Of course that's nothing to be relied on on its own but maybe as an additional layer of defense?

[ Parent | on HN ]

Re:Python Malware Starting to Employ Anti-Debug Techniques by revolvingocelot on Friday December 23, 2022 @09:00AM (#34105861)

Makes me think of that "weird domain name"-based ransomware mitigation.

https://www.theverge.com/2017/5/13/15635050/wannacry-ransomw...

[ Parent | on HN ]

Re:Python Malware Starting to Employ Anti-Debug Techniques by dylan604 on Friday December 23, 2022 @12:11PM (#34108199)

or adding a russian language pack to your system. some of these are so silly sounding that they are almost unbelievable on first hearing of them.

[ Parent | on HN ]

Re:Python Malware Starting to Employ Anti-Debug Techniques by fear-anger-hate on Friday December 23, 2022 @12:13PM (#34108216)

Some EDRs do stuff like adding russian keyboard layout as an alternative, which stops a fair share of 'malware as service' type stealers.

[ Parent | on HN ]