Analyzing BlackMatter Anti-Debug With IDA Pro
Added 2021-10-15 17:00:15 +0000 UTCIn this tutorial we analyze the anti-debug checks in BlackMatter ransomware with IDA Pro. We use static analysis to determine exactly what the checks are doing.
BlackMatter sample:
Anti-debug feature explained:
Anti-Debug NtSetInformationThread
Comments
I should have explained this better, there are some Windows tricks that are assumed with handles. Null for the main thread is translated into -2 for the current thread, or if a valid handle is passed in (not null) then they use the handle that was passed. In this case they are passing null that is translated into -2 for current thread. You can see the cast here in the POC code https://anti-debug.checkpoint.com/techniques/interactive.html#ntsetinformationthread
OALABS
2023-10-31 21:10:20 +0000 UTCI'm not quite understand how the second anti-debug detects the debugger. From the code, seems it check the thread number whether it's 0(false), if not then hide the main thread from debugger. The question is, will the main thread number to be changed when the executable loaded by debugger?
Y G
2023-10-31 20:19:12 +0000 UTC
