In this chapter, we have seen how encryption or packing is used to protect the whole malware. Here, we will look at other implementations of these encryption algorithms inside the malware code for obfuscation and for hiding malicious key characteristics. These key characteristics can be used to identify the malware family using static signatures or even network signatures.
In this section, we will take a look at a known banking trojan called Vawtrak. We will see how this malware family encrypts its strings and API names, and obfuscates its own network communication.
