Encryption is the most common technique as it also protects malware from antivirus static signatures. Malware can encrypt its own code and have a small piece of stub code to decrypt the malicious code before executing it. The malware can also encrypt its own data, such as strings, API names, and their C&Cs.
Dealing with encryption is not always easy. One solution is to execute the malware and dump the memory after it is decrypted. You can dump the process memory using the Sysinternals tool called ProcDump, and the command line looks like:
procdump -ma <process name/pid>
This will dump the whole process and its memory. If you only want the process image, you can use -mm to create a Mini process image. Also, many sandboxes, now can make process dumps of the monitored processes, which will help you get the malware in a
decrypted form.
But for cases like encrypting strings and decrypting each string on demand, you will need to reverse the encryption algorithm and write...
