Tricks up malware's sleeve: Understanding malware polymorphism and metamorphism

Okay, I'm just going to come out and say it—malware is cool! Yes, it's a pain, and yes, it can be catastrophic, but seriously, the malware coming out these days sometimes has such exquisite features that you end up grudgingly appreciating the mysterious ways malware works.

Now, just because I said malware is cool, does not mean I think it should stick around. We're shaping each of the posts in this blog to help you detect and defeat malware so your organization stays safe. This particular post is on polymorphic malware and metamorphic malware—malware that can alter its genetic makeup to avoid detection. (See why I said it’s cool?) We'll also explore how to detect this malware in your network.

So, how popular is this cool strain of adaptive malware? Well, Webroot research reveals that since 2017, most malware strains detected have been polymorphic in nature. The research specifies that 94% of malicious executables are polymorphic. Research and surveys related to metamorphic malware seem scarce. Nevertheless, these are strains of malware any organization might encounter, and it is useful to be armed with knowledge of how to detect them in your environment.

What is polymorphic malware?

Polymorphic malware is a type of malware that can constantly change its features and signatures to make it undetectable by security solutions. It dupes detection techniques by altering characteristics like file names and encryption keys. This is an effective method to evade detection because security solutions use pattern detection techniques to spot malware signatures. The malware can spread through the network, changing its signature and rendering it too powerful for signature-based detection tools, which rely on a database of known malware signatures and patterns.

Something that organizations should keep in mind is that when it comes to malware, the traditional approach of focusing your cybersecurity program (and its budget) on prevention of malware rather than detection is not effective. With a surge of polymorphic malware infections, you need to rethink security approaches and spending, and focus more on advanced detection mechanisms.

What is metamorphic malware?

Metamorphic malware takes polymorphic malware strains to a whole new level. It is now considered the most infectious strain of malware out there. Metamorphic strains of malware can translate and rewrite their own code. This type of malware alters the overall anatomy of its being by rewriting and reprogramming itself each time it corrupts a network. (Yikes!) Thankfully, metamorphic malware hasn't become a common occurrence as creating it requires advanced coding knowledge.

The goal of both polymorphic and metamorphic malware has normally been to steal information for extortion purposes. If you're wondering how metamorphic and polymorphic malware differ, here are a couple of differences.

Let's make this simpler. Polymorphic malware is like a chameleon that changes its color to camouflage itself.

A metamorphic strain of malware is where the chameleon transforms itself into a lizard.

How to detect these types of malware

• Use behavior-based detection tools: Leverage behavior-based detection solutions like endpoint detection and response, or advanced threat protection, for real-time threat detection. Behavior-based malware protection is more accurate than traditional signature-based methods, which are ineffective against polymorphic attacks.
• Perform heuristic scanning: Look for crucial traits the threat might share, instead of an exact match to known threats. This improves the odds of detecting and stopping a new variant of the virus.
• Leverage deep content inspection: Since so much of the malware changes internally in both these strains, we need to go deeper than the normal deep packet inspection technique to identify polymorphic or metamorphic malware strains. Deep content inspection is relatively new, but it can detect evasive malware strains as it doesn't just inspect the header of packets but actually reconstructs and decodes the packet to check the actual packet contents for malware.