Modern Malware: Evasion Tactics Using Obscure Programming Languages

Malware authors are stepping up their game by turning to the unexpected—and sometimes downright obscure—programming languages. In a recent deep-dive study, researchers from Greece and the Netherlands explored how switching from the familiar C and C++ can throw static analysis tools for a loop. This research, outlined in a preprint paper provocatively titled "Coding Malware in Fancy Programming Languages for Fun and Profit," exposes a shift that could have wide-reaching implications for Windows security.

A New Twist in Malware Craftsmanship​

For decades, malware has been synonymous with C or C++ code, largely owing to their speed and the deep integration with traditional Windows compilers like Microsoft’s Visual C++. However, the study reveals that modern adversaries are increasingly embracing languages such as Delphi, Haskell, Lisp, Rust, and even Go as a deliberate method of evasion. By stepping away from the norm, these malware authors are effectively obscuring their code’s behavioral patterns and sidestepping the signature-based detection methods that many antivirus and static analysis tools rely on.
The researchers—Theodoros Apostolopoulos, Vasilios Koutsokostas, Nikolaos Totosis, Constantinos Patsakis, and Georgios Smaragdakis—unearthed evidence that not only does the choice of language matter, but that the compiler used can also meddle with detection rates. Their meticulous analysis, which involved examining nearly 400,000 Windows executables gathered from Malware Bazaar, shows that the binary’s hidden internal structure is profoundly affected by the language and compilation strategy employed.

Programming Languages as a Tool for Evasion​

Obfuscation by Obscurity​

One of the critical insights from the research is that using a less-popular programming language can serve as an effective layer of obfuscation. Traditional static analysis seeks out recognizable patterns—often educated guesses based on common compiler fingerprints and known malware signatures. When a malware author writes code in an unconventional language, three major challenges arise for analysts:
• The standard function calls and library implementations differ markedly, meaning automated tools struggle to match typical shellcode patterns.
• Programs compiled in these languages can generate binaries with fragmented and irregular byte sequences.
• The increased complexity in multi-threading and the use of indirect calls further muddle the waters, making the already difficult job of reverse engineering even more tedious.
For instance, while malware drawn up with C or C++ tends to exhibit predictable patterns—like retaining sequential shellcode bytes or consistent gaps—those developed in languages like Lisp, Haskell, or Rust often scatter these bytes unpredictably. The outcome? Static detection methods based on pattern matching falter, allowing these malicious executables to slip under the radar.

The Role of Compilers​

It’s not just the language itself but the compiler behind the code that can tip the scales in favor of malware evasion. The study points to non-standard compilers, such as Embarcadero Delphi, Pelles C, or Tiny C, as culprits for lowering detection rates even further. With fewer samples available for these compilers, antivirus vendors find it challenging to establish robust detection rules—a clear case of “sparse data” working in the malware writers’ favor.

Diving Deeper: Methodology and Findings​

Static Analysis Under Fire​

Static analysis has long been a cornerstone of malware detection for Windows users. The process involves scanning executable files without running them, relying on signature matching and structural heuristics to flag potentially malicious behaviors. However, when the underlying code is engineered in an unconventional language, several complications can arise:

1. Irregular Byte Patterns: Languages like Lisp and Haskell don’t just change the syntax—they alter the memory layout of the compiled binary. This leads to fragmented shellcode that defies the fixed pattern matching many detection algorithms depend on.
2. Expanded Standard Libraries: Languages such as Dart or Go include a broad swath of functions by default, which can clutter the binary. Even a simple malicious payload might seem convoluted when wrapped in a complex, multi-layered environment.
3. Compiler Specificity: The statistical scarcity of samples compiled with non-mainstream compilers means that detection tools are less likely to have “learned” about these outliers, resulting in missed flags during routine scans.

The researchers reinforced these points by testing binaries from a range of malware families. They noted that signature creation—a time-tested method for catching known threats—is rendered less effective when faced with code that deviates from anticipated norms. What should be a straightforward bottleneck in a typical binary becomes a convoluted exercise in puzzle-solving for antivirus algorithms.

Real-World Malware Trends​

The practical implications of these findings are significant. Consider the case of advanced persistent threats (APTs), where adversaries are known for their sophisticated and multi-pronged attack strategies. The study cites APT groups like APT29, which have diversified their programming approach. For example:
• In the Masepie malware campaigns targeting Ukraine, APT29 turned to Python—an atypical choice for high-level banking on stealth.
• In Zebrocy, they mixed languages including Delphi, Python, C#, and Go, further complicating the static analysis landscape.
• Other groups, such as those behind ransomware like Akira, BlackByte, and Hive, have shifted from traditional candidates (C/C++ or C#) to languages like Rust and Go.
This shift is more than a technical curiosity—it signals an evolution in the threat landscape, one where attackers deliberately leverage the nuance of programming language design to dodge static detection mechanisms.

What Does This Mean for Windows Users?​

A Call for Adaptive Security​

For Windows users, particularly those in corporate or high-risk environments, these findings underscore the need for multi-layered defense strategies. Relying solely on static analysis for threat detection might not be sufficient in the coming years. Instead, security frameworks must evolve to integrate dynamic analysis methodologies and behavior-based detection systems that can adapt to increasingly sophisticated evasion tactics.

Key Considerations for Enhanced Protection​

• Regularly update your antivirus software to ensure it integrates the latest research findings and detection rules for non-traditional malware samples.
• Employ behavior analysis tools in addition to traditional signature-based scanners. Dynamic analysis can catch malicious behaviors that static methods might miss.
• Encourage an environment of continuous learning and adaptation among IT security professionals. Understanding the nuances of various programming languages—and the peculiarities of their compiled binaries—is essential.
• Consider investing in research and training that highlights emerging trends in malware development. Awareness is the first step in countering any threat.

Broader Implications for the Cybersecurity Community​

This study isn’t just a wake-up call for Windows security—it’s a broader commentary on how the cybersecurity landscape must evolve. Threat actors have long leveraged “security through obscurity” as a tactic. By adopting less familiar programming languages, they are effectively betting that the analyst community will continue to rely heavily on static analysis without adequately adapting to the changing code ecology.
Rhetorically speaking, one might ask: If malware authors can choose from a veritable buffet of programming languages, can our static analysis techniques keep up? The answer appears to be that without significant evolution, the answer is likely “no.” Static detection remains a vital first line of defense, but it is now clear that supplemental, adaptive methods are necessary to cope with modern challenges.

Expert Analysis: A Balancing Act​

The research offers a balanced view: while language diversity aids malware evasion, it also forces threat actors to contend with increased reverse engineering complexity. In other words, while choosing an obscure language can lower detection rates, it simultaneously raises the bar for the attackers in terms of development time and resources. Malware authors must now consider the trade-off between ease of reverse detection and the operational complexity of developing and maintaining their codebase.
For Windows security teams, this means that intelligence sharing and updating threat libraries must be a continuous process—a dynamic interplay where every new development in programming language usage could inform the next generation of detection heuristics. The onus is on both commercial security vendors and independent security researchers to bridge this knowledge gap by studying these novel techniques and adjusting their defensive measures accordingly.

Looking Ahead: Preparing for Future Threats​

Given the rate at which malware authors are diversifying their toolset, it’s clear that the traditional, one-size-fits-all approach to malware detection is no longer adequate. The future of Windows security lies in a combination of:
• Advanced static analysis that can accommodate multiple programming languages,
• Heuristics and behavior-based algorithms capable of adapting on the fly, and
• Increased collaboration between researchers, developers, and security professionals.
At its core, the evolving malware landscape reminds us that in cybersecurity, complacency isn’t an option. Just as threat actors innovate by leveraging the subtleties of lesser-known programming languages, defenders must continually iterate on their detection and remediation strategies. The battle is not just about patching vulnerabilities in Windows systems—it’s about staying one step ahead of adversaries who are willing to reinvent the rules of engagement.

Key Takeaways​

• Malware is increasingly being written in non-traditional languages such as Delphi, Haskell, Lisp, Rust, and Go.
• This change hinders static analysis tools that rely on established signatures and binary patterns typical of C/C++ code.
• Non-standard compilers exacerbate the issue by producing binaries that further deviate from expected norms.
• Windows security must adopt more dynamic and behavior-based detection strategies to keep pace with these evolving threats.
• Collaboration and continuous research are essential to ensure that detection technologies can adapt to this emerging landscape.
For Windows users and security professionals alike, this study is a stark reminder that threats are evolving in unpredictable ways. As malware authors experiment with the full spectrum of programming languages, they blur the lines between traditional and unconventional tactics—and they force everyone in the cybersecurity community to rethink what “detection” really means.
In the end, while writing malware in Lisp or Haskell might sound like an eccentric hobby, it’s a strategic maneuver aimed at evading detection. As defenders, we must be equally creative and adaptive in our countermeasures. The age of one-dimensional security strategies is over; it’s time for a multi-faceted approach that can handle the complexities of tomorrow’s malware.

---

Source: The Register Malware is harder to find when written in obscure languages