Abstract

In this talk, we'll see how the FinSpy malware tries to hide its payload from being analyzed. First we'll take a look at the obfuscation and virtualization layer and what options do we have, as reverse engineers, to speed-up analysis of code of this kind. Virtualization often scares people, but it's just a matter of time and patience. Once we get rid of the virtualization, the next step would be to check what other anti-analysis measures the malware is using like anti-debugging, anti-sandboxing, anti-AV, etc... and of course some of the interesting tricks the malware uses in order to hide its presence on the system.