chameleon-rs
Prototypes on polymorphic, metamorphic and poly-metamorphic malwares in Rust.
Disclaimer
This project is for educational purposes only. It has been made to get a better understanding of polymorphic and metamorphic code concepts.
Quartz and its members are not responsible for your usage of this project.
Acknowledgments
This project is inspired by the great work of the PoC Innovation team on the WhiteComet-Research project.
Go check their work as well as their other projects to learn more about innovative topics!
Introduction
A unique yet very elegant technique for a malware to avoid being detected by anti-viruses is to alter its signature.
There are many ways to achieve this:
-
Polymorphism: The dedicated page on Wikipedia explains the concept very well, "the code changes itself every time it runs, but the function of the code (its semantics) will not change at all".
-
Metamorphism: When the malware edits and rewrites its own code each time it is run. Here the semantics changes, but the injected code can be composed of NOPs only.
-
Poly-Metamorphism: Combining both previous techniques, the malware will change and encrypt its own code each time it is run.
In this project, chameleon-rs, we developed prototypes for each one of the techniques described above.
To make things more challenging, we used the Rust programming language to demonstrate the capacity of using modern tools with a lot of external support available. That is, shaping malwares that could use modern third-party libraries (the Rust crates).
Getting Started
To be able to test all the malwares on all platforms, we wrote a Dockerfile for a simple container which builds the binaries.
You can build and run it using the following commands:
docker build . -t chameleon-rs
docker run --rm -it chameleon-rs
Once in the container, execute the malware as many times as you wish. In the following example, we compute the sha256 hash for the binary (which must change between each execution):
# Initial binary hash.
sha256sum ./target/debug/polymorphic #549a821e28b6dd03e6d430852447d6f7b425f2e26da3eab49e044c86a53cf59b
# Execute the binary for the first time.
./target/debug/polymorphic
# New binary hash, malware signature has changed.
sha256sum ./target/debug/polymorphic #e0479c6b7d2af8b5f6ccf55561e4ba400653450dccd8871f8b558fcf29fa1cb3
Polymorphic Malware
The sources for this prototype are available in the
polymorphicfolder.
Want to learn more about how it works ? Check out the dedicated README file !
Metamorphic Malware
Coming soon !
Poly-Metamorphic Malware
Coming soon !
Conclusion
We learned a lot during the development of those prototypes. Go on and take a look at the code, try to understand what it does, how things could be improved, invent new ways to prevent those attacks.
Authors
Made with ๐ and โค๏ธ by the ๐ฆ at Quartz.
1.2k Dec 30, 2022
2.2k Dec 30, 2022
10.4k Jan 4, 2023
4 Sep 3, 2022
2 Apr 20, 2022
2 Aug 13, 2022
36 Jan 28, 2023
16 May 29, 2023
104 Oct 7, 2023
69 Dec 13, 2022
1 Oct 26, 2021
12 Nov 5, 2022
26 Dec 29, 2022
101 Nov 12, 2022
3 Jan 18, 2023
16 Mar 6, 2023
13 May 4, 2023
10 Sep 4, 2023
19 Nov 29, 2022
3 Oct 18, 2021
1 Apr 19, 2022
3 Oct 5, 2022
104 Nov 8, 2022
76 Dec 28, 2022
36 Jan 12, 2022
6 Dec 30, 2022
2.3k Jan 3, 2023
73 Aug 4, 2022
3 Mar 17, 2022