Unveiling Crypto Miner’s Stealthy Tactics: The Rise of Indirect Syscalls for Evasion

Recently we got our hands on a set of samples which had a big data section with high entropy and had fake executable information like WinRar, Chrome, CustomRP, etc. Out of curiosity we analysed one but we weren’t able to find any interesting Win32APIs used by this sample. When we reversed the sample we came to know that it was using Indirect Syscall.

Indirect Syscalls aren’t new, it’s been around for a while which is mainly employed by offensive teams …

big big data chrome crypto crypto miner curiosity data entropy etc evasion fake find hands on high information malware analysis miner sample syscalls tactics winrar