Evasion Games: Dissecting Malware Evasive Techniques Across Packers, Sandboxes, and Debuggers
TL;DR
An updated and extended taxonomy of evasive techniques is provided, identifying 55 newly documented methods and the extent to which 25 commercial and publicly available packers embed evasive behaviors into obfuscated binaries is evaluated.
Abstract
Malware authors increasingly leverage evasive techniques to conceal malicious behavior from dynamic analysis tools. Despite prior efforts to categorize such techniques, the resilience of existing analysis environments—sandboxes and debuggers—against them remains underexplored. In this work, we provide an updated and extended taxonomy of evasive techniques, identifying 55 newly documented methods. We then evaluate the extent to which 25 commercial and publicly available packers embed evasive behaviors into obfuscated binaries. Finally, we assess the readiness of seven online sandboxes and four debuggers in handling these techniques. Our experiments reveal a significant disparity: while sandboxes generally exhibit higher readiness against anti-debugging and anti-virtualization techniques, they are still vulnerable to miscellaneous evasions, particularly timing-based attacks. Conversely, debuggers prove less effective overall, with only 27% of evasions successfully countered. These findings underscore the persistent limitations of current analysis environments and motivate the development of more robust anti-evasion strategies.