ESET Resource Center

Under the hood of Wslink’s multilayered virtual machine

March 2022

Under the hood of Wslink’s multilayered virtual machine

ESET researchers recently described Wslink, a unique and previously undocumented malicious loader that runs as a server and that features a virtual-machine-based obfuscator. In this white paper, we describe the structure of the virtual machine used in samples of Wslink and suggest a possible approach to see through the obfuscation techniques used in the analyzed samples. We demonstrate our approach on chunks of code of the protected sample.

During our research, we were able to successfully design and implement a semiautomatic solution capable of significantly facilitating analysis of the underlying program’s code. The virtual machine introduced a diverse arsenal of obfuscation techniques, which we were able to overcome to reveal a part of the de-obfuscated malicious code that we describe in this document.

In the last sections of this analysis, we present parts of the code that we developed to facilitate our research. This white paper also provides an overview of the internal structure of virtual machines in general, and it introduces some important terms and frameworks that are used in our detailed analysis of the Wslink virtual machine.

Don't miss out



Cybersecurity in an AI-turbocharged Era

AI can be used for both good and evil. Find out how it transforms the world of digital security, how cybercriminals use it, and how ESET leverages the technology to keep you secured.



Prevention first: Minimizing the Attack Surface and Closing Compliance Gaps

Prevention is key when protecting your company against threats. Learn about mobile protection, cloud protection, and...



Radicati APT Protection Market Quadrant 2024

ESET has been named a 'Top Player' by Radicati in the Advanced Persistent Threat Market Quadrant 2024. See the evaluation!

Ready for next step?

Enter the world of enterprise protection