New Moonwalk++ PoC Demonstrates How Malware Can Forge Windows Call Stacks to Evade Detection

Cybersecurity: Moonwalk++ Malware Evasion Technique

Security researchers have identified a new malware evasion technique named Moonwalk++. This method allows malware to disguise itself by manipulating Windows call stacks, thereby bypassing modern endpoint detection systems.

Moonwalk++ builds on previous research into Stack Moonwalking, exposing vulnerabilities in how security tools verify malware calls to sensitive Windows functions. By altering the function call chains in system memory, the technique makes malicious code appear as though it originates from legitimate software.

The technique forges call stack data, misleading security tools by pointing to legitimate Windows system functions. This method exploits the way Windows records function calls, masking the actual origin of the malware.

Moonwalk++ can encrypt malicious code during execution, a capability not present in earlier versions. This is achieved through stack manipulation, allowing the malware to evade detection while running.

Researchers tested Moonwalk++ against several detection tools, including Hunt-Sleeping-Beacons and Hollow's Hunter. These tools failed to detect the technique when integrated into legitimate processes such as OneDrive.exe.

Removing references to malicious code from the call stack Making threads appear to originate from legitimate functions Concealing suspicious memory regions

The research, initially presented at DEFCON 31, underscores the limitations of relying solely on call stack analysis. It advocates for enhanced detection strategies that include behavioral analysis, memory pattern monitoring, and API usage review.

Security teams can access the full technical details and proof-of-concept code to further study and mitigate such advanced evasion techniques.

Based on reporting by GBHackers.