Procedure examples

Pikabot features several methods to evade debugging by analysts, including checks for active debuggers, the use of breakpoints during execution, and checking various system information items such as system memory and the number of processors.

Bumblebee can search for tools used in static analysis.

TONESHELL has leveraged custom exception handlers to hide code flow and stop execution of a debugger.

PUBLOAD has embedded debug strings with messages to distract analysts. PUBLOAD has leveraged `OutputDebugStringW` and `OutputDebugStringA` functions.

Mafalda can search for debugging tools on a compromised host.

Raspberry Robin leverages anti-debugging mechanisms through the use of ThreadHideFromDebugger.

RustyWater has registered a Vectored Exception Handler (VEH) to catch debugging efforts.

DRATzarus can use `IsDebuggerPresent` to detect whether a debugger is present on a victim.

DarkTortilla can detect debuggers by using functions such as `DebuggerIsAttached` and `DebuggerIsLogging`. DarkTortilla can also detect profilers by verifying the `COR_ENABLE_PROFILING` environment variable is present and active.

ROKRAT can check for debugging tools.

PlugX has made calls to Windows API `CheckRemoteDebuggerPresent` and exits if it detects a debugger.

Lumma Stealer has checked for debugger strings by invoking `GetForegroundWindow` and looks for strings containing “x32dbg”, “x64dbg”, “windbg”, “ollydbg”, “dnspy”, “immunity debugger”, “hyperdbg”, “debug”, “debugger”, “cheat engine”, “cheatengine” and “ida”.

PureCrypter has the ability to call `CheckRemoteDebuggerPresent`.

DarkGate checks the BeingDebugged flag in the PEB structure during execution to identify if the malware is being debugged.

LockBit 3.0 can check heap memory parameters for indications of a debugger and stop the flow of events to the attached debugger in order to hinder dynamic analysis.

ThiefQuest uses a function named is_debugging to perform anti-debugging logic. The function invokes sysctl checking the returned value of P_TRACED. ThiefQuest also calls ptrace with the PTRACE_DENY_ATTACH flag to prevent debugging.

Latrodectus has the ability to check for the presence of debuggers.

Saint Bot has used `is_debugger_present` as part of its environmental checks.

The Black Basta dropper can check system flags, CPU registers, CPU instructions, process timing, system libraries, and APIs to determine if a debugger is present.

StrelaStealer variants include functionality to identify and evade debuggers.

XLoader uses anti-debugging mechanisms such as calling `NtQueryInformationProcess` with `InfoClass=7`, referencing `ProcessDebugPort`, to determine if it is being analyzed.

ANELLDR can call `ZwSetInformationThread` with the second argument set to `ThreadHideFromDebugger (0x11)` to evade being debugged.

StealBit can detect it is being run in the context of a debugger.

AsyncRAT can use the `CheckRemoteDebuggerPresent` function to detect the presence of a debugger.