The Journal on Cybercrime and Digital Investigations
The Journal on Cybercrime & Digital Investigations (CybIN) is published by CECyF, the French Cybercrime Centre of Excellence. The purpose of this journal is the publication of articles in the scientific, technical, legal and other disciplines that contribute to the understanding and the fight against cybercrime, as well as the practice of digital investigations.
Authors who publish with this journal agree to the following terms: Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal. Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
mirai-toushi: Cross-Architecture Mirai Configuration Extractor Utilizing Standalone Ghidra Script
In recent years, IoT malware frequently launches DDoS attacks, causing massive damage to ISPs. Since Mirai and its variants account for the vast majority of IoT malware, security researchers develop configuration extracting tools to understand its characteristics. However, Mirai is built on diverse architectures (e.g., ARM, MIPS, and PowerPC), developing tools is challenging. Indeed, existing tools only support 1 or 2 architectures. In this study, we utilize Ghidra decompiler and intermediate representation P-Code to reduce architecture-dependent codes, and develop Mirai configuration extractor "mirai-toushi" that supported 8 architectures. To evaluate mirai-toushi against real-world malware, we applied mirai-toushi to 2,426 samples collected in honeypot/IPS from March 2020 to March 2024. The existing tool extracted 673 tables containing data such as C2 server destinations and DoS parameters, while mirai-toushi extracted 1,743 tables. In addition, mirai-toushi extracted 1,641 password lists. The results show that mirai-toushi can extract Mirai configurations effectively. To be widely used by security researchers, we have made mirai-toushi publicly available on GitHub.
Copyright (c) 2025 Shun Morishita (Author) https://creativecommons.org/licenses/by/4.0
A Taxonomic Overview of Prevalent Malware Communication Strategies
Malware analysis remains a critical task in cybersecurity, particularly given the prevalent use of network capabilities by many malware samples. Despite the need to discuss and understand the use of networking in malware, there is currently no comprehensive taxonomy to classify the various aspects of malware C&C communication. This lack of taxonomy has resulted in the absence of a categorized overview of the communication strategies utilized by prevalent malware. Furthermore, no structured data set is available that includes representative samples of common malware families along with their respective network traffic captures, which is crucial to develop new malware networking analysis methods or to improve manual analysis skills. In this paper, we make three main contributions. First, we propose a taxonomy for malware C&C communication strategies, adapted and expanded from the Trend Micro botnet taxonomy, to ensure that it can be systematically applied to categorize and describe C&C communication methods more broadly. Second, we provide an organized summary of the current malware C&C communication landscape, based on the malware families most frequently submitted to MalwareBazaar, to give researchers an overview of common techniques. Third, we release a data set containing samples of these prevalent malware families together with live network traffic captures to facilitate research and the development of new tools for malware networking analysis.
Copyright (c) 2024 Steffen Enders, Daniel Plohmann, Manuel Blatt (Author) https://creativecommons.org/licenses/by/4.0
GenRex Demonstration: Level Up Your Regex Game
GenRex is a unique tool for detecting similarities in artifacts from executable files and the generation of regular expressions. This paper demonstrates how to use GenRex to maximize the usage of regular expressions automatically created from behavioral reports and other potential use cases. GenRex is open-sourced, and additional resources, such as a dataset of behavioral reports and an extension to the YARA tool, are provided.
Copyright (c) 2024 Dominika Regéciová (Author) https://creativecommons.org/licenses/by/4.0
IoT Malware and Rookit Detections Using Electromagnetic Insights: Unveiling the Unseen
The Internet of Things (IoT) is a collection of interconnected devices, becoming increasingly complicated and suffering from inadequate security measures. They frequently employ outdated hardware and software without taking security risks into account, which makes them a target for cybercriminals, particularly those specializing in malware and rootkits. In this paper, we will present two strategies for exploiting electromagnetic side channels and address two challenges: malware classification in the presence of obfuscations and rootkit detection. Our approach focuses on IoT devices, specifically targeting ARM and MIPS architectures in Raspberry Pi and Creator CI20 devices. The framework employs advanced data preprocessing methods, allowing analysts to select a variety of machine learning and deep learning models based on their specific requirements. Our finding were published separately at (including data and codes): - ACSAC-2021: "Obfuscation Revealed: Leveraging Electromagnetic Signals for Obfuscated Malware Classification" (with an extended version presented at hardwear.io’22 USA), - RAID-2022: "ULTRA: Ultimate Rootkit Detection over the Air".
Malware classification, obfuscation, side-channel analysis, rootkit detection, software-defined radio (SDR), machine learning, deep learning, Electromagnetic, IoT devices
Copyright (c) 2024 Damien Marion, Duy-Phuc Pham, Annelie Heuser (Author) https://creativecommons.org/licenses/by/4.0
CMK Rootkit. Identifying the ”magic packet” requirements via pattern recognition
The present paper analyzes the CMK Linux Kernel Rootkit. It demonstrates that it is possible to unpack the rootkit using emulation to avoid inserting the module in a real Linux distribution matching specific Linux kernel requirements. CMK Rootkit implements "magic packets", this study also demonstrates that it is possible to extract the requirements for the "magic packets" based on assembly language patterns. We provide the implementation for both, the Linux kernel rootkit unpacker and a Ghidra script for extracting the requirements of the "magic packets".
Copyright (c) 2024 David Álvarez Pérez, Manuel Fernández-Veiga (Author) https://creativecommons.org/licenses/by/4.0
The following position paper discusses the topic of employee criminal liability in the context of ransomware attacks. Through a series of case studies, it analyses whether, under Swiss law, employees who have facilitated the success of an attack can be qualified as co-authors or accomplices. After an overview of the applicable legal framework, this paper analyses three case studies inspired by actual ransomware attacks. It focuses in particular on the element of intent, which is a prerequisite in most cybercrime laws, and which can, under certain conditions, also be applied to behaviours that appear to be the result of "mistakes"; it also discusses the role that in-house cybersecurity training (or the lack thereof) can have in this context. Drawing from the results of the analysed cases, this paper then presents a series of recommendations aimed at reinforcing cybercrime prevention within institutions, while also touching upon topics such as cyber-insurances and certification labels.
Copyright (c) 2023 Renaud Zbinden, Luca Brunoni, Olivier Beaudet-Labrecque (Author) https://creativecommons.org/licenses/by/4.0
MCRIT: The MinHash-based Code Relationship & Investigation Toolkit
As the number of malware attacks continually rises, malware analysts are facing an ever-increasing workload. The growing complexity of malware families and the sheer volume of new threats make it challenging for analysts to keep up with their analysis tasks. Code similarity analysis offers high potential in this regard, helping analysts to orient themselves and to speed up analysis. While being a very active research field with many recent publications, only few of these focus on malware or support immediate practical usage, as they are rarely accompanied by public code releases. In this paper, we present the MinHash-based Code Relationship & Investigation Toolkit (MCRIT). MCRIT is intended to serve as a framework for code similarity analysis, mainly focusing on One-to-Many (1:N) comparisons and with the ability to recognize and filter out library code. We publish MCRIT as open source, including a dockerized setup for easy deployment.
Copyright (c) 2023 Daniel Plohmann, Manuel Blatt, Daniel Enders (Author) https://creativecommons.org/licenses/by/4.0
Incremental Clustering of Malware Packers using features based on Transformed CFG
Packer detection is an important topic because most malware is packed and this allows it to avoid detection based on static analysis. Identifying classes of packers is the key to effective detection because it makes it easier to determine from a static analysis whether further analysis is needed or whether a decision is already possible. Thus in this work we propose new features to cluster packers from their unpacking function. This method makes it possible to effectively cluster packers, and is able, by clustering, to identify packer classes used by malware. It is a step towards a larger data clustering allowing to identify custom packers.
Copyright (c) 2023 Ludovic Robin (Author) https://creativecommons.org/licenses/by/4.0
This paper proposes a system for collecting and structuring blog articles about cyber-attacks, with the goal of improving the ability of security researchers to compare threat actor modus operandi. By grounding our work in the field of criminology, we also formulate a Cyber Operation Constraint Principle that could inform future research. We derived from it a tool, the AbductionReductor, that has the potential to augment partial knowledge about a threat actor's behaviour while investigating its actions. Our approach has the potential to significantly support cyber threat analysis and investigation. Future research must focus on the challenge of synchrony and diachrony linguistic analysis.
Copyright (c) 2023 Ronan Mouchoux, François Moerman (Author) https://creativecommons.org/licenses/by/4.0
Syslogk Rootkit. Executing Bots via "Magic Packets"
The proliferation of open source Linux kernel rootkits allows malware writers to speed up the process of developing complex malware. This study analyzes the Syslogk Linux kernel rootkit family which reuses code of Adore-Ng. Syslogk allows to remotely execute arbitrary commands and a hidden bot in different modes via "magic packets". Analyzing "magic packets" in reasonable time is a challenging task. Furthermore, the hidden bot, implements a proxy mode that allows to hide the IP address of the attacker while executing commands in other infected machines. This new botnet structure can also inspire future Linux threats, including IoT threats.
Copyright (c) 2023 David Álvarez Pérez (Author) https://creativecommons.org/licenses/by/4.0
Yara Studies: A Deep Dive into Scanning Performance
You probably know this scenario - you spent a while analyzing new samples, which was not easy, but you’re finally done. You also created a neat Yara rule to match the samples, and you're ready to send it off and move on to your next task (or lunch). But oopsie - the Yara rule is warning of slowed scanning. Or your colleague comments they do not like a particular part and wants to be sure the rule is effective. While working with Yara, I consulted with many analysts about this problem. They knew what they wanted to detect, but Yara was not always helping them write the rules more effectively. Based on my experience with algorithms used in Yara, we worked together to find a solution to improve scanning speed and limit potential hurdles for future usage. This paper presents five studies with descriptions of the five problems, an explanation of why Yara does not like the first solution, and tips on what can be improved. Note that no sensitive information is disclosed in this paper. All studies were anonymized, so the general problem is the same, but there is no direct link to a specific malware family mentioned, nor can it be tracked.
Copyright (c) 2023 Dominika Regéciová (Author) https://creativecommons.org/licenses/by/4.0
Scambaiting as a Preventive Tool in the Fight against Cyberfrauds: the Case of Romance Scams
The following paper discusses the potential of using scambaiting techniques to mitigate online fraud. It draws from the experience and the results of a recent project led by the authors, in which researchers posed as targets on dating platforms and interacted with criminals engaging in romance scams – a prominent type of fraud that generates massive economic and emotional damages. The aim of the project was to model their modus operandi, use the gathered data to explore possible ways to disrupt and frustrate further criminal conduct, and evaluate the potential of such techniques. After providing the scientific context of the project, this paper will detail the methodology and the strategies used by the research team for their scambaiting experiment. A brief survey of the most interesting results will then be presented. The last part of this paper will focus on the challenges and opportunities of using scambaiting as a law enforcement tool to fight online fraud.
Copyright (c) 2023 Renaud Zbinden, Olivier Beaudet-Labrecque, Flore Grandjean, Cloé Gobeil, Luca Brunoni, David Décary-Hétu, Cristina Cretu-Adatte (Author) https://creativecommons.org/licenses/by/4.0
Offenders seek online private discussion forums where participants are screened before gaining access to connect with sophisticated peers and evade detection. Past research finds that most public discussion forum participants have a low level of technical skill and rely on more established participants for the tools and techniques they need to commit their offences. To date, research has mostly focused on public discussion forums of online offenders as gaining access to private forums comes with many challenges. The aim of this research is to describe and understand the impacts of the private nature of discussion forums on their participants’ activities. Our driving hypothesis is that private discussion forums are host to more sophisticated participants that will, in turn, offer and have access to more sophisticated tools. To understand the impacts of the private nature of discussion forums, we selected two discussion forums available on the internet whose focus is the sale of malware; one of them is private, while the other is public. Our analysis suggests that while there are differences between private and public discussion forums, there are few significant differences between both inters of the products they advertise.
Copyright (c) 2024 Renaud Zbinden, Sandra Langel, Olivier Beaudet-Labrecque, David Décary-Hétu, Luca Brunoni (Author) https://creativecommons.org/licenses/by/4.0
Yara: Down the Rabbit Hole Without Slowing Down
Terry and John are two malware analysts working for an unnamed antivirus company. Terry has worked there for many years, and he is helping John, who started recently, to learn more about their work. John is starting to use Yara -- an excellent tool for the description and detection of malware families. With Terry, they are analyzing potentially malicious samples, and they are creating so-called Yara rules. This is not a simple task to do -- Yara may be easy to use, but it is difficult to master. How to write the best rule possible? The rule that is good in detection, precise, but also fast? Luckily, they have help - a researcher Caitlin, who is not scared to get really deep into Yara. Today, all three of them will go deeper into Yara than ever before -- the journey to the rabbit hole can begin.
Detect emerging malware on cloud before VirusTotal can see it
In this paper, we present a new methodology to discover emerging malware where new malware candidates are continuously discovered by our general anomaly detection, and the graph learning system predicts the behavior and the threat family using fuzzy similarity via a correlation knowledge graph to support further analysis by the security researchers, or for the automatic enforcement and remediation. This methodology can be applied at large scale to detect and analyze emerging malware while providing rich contextual information.
Copyright (c) 2024 Thanh Nguyen, Gan Feng, Andreas Pfadler, Anastasia Poliakova, Ali Fakeri-Tabrizi, Hongliang Liu, Yuriy Yuzifovich (Author) https://creativecommons.org/licenses/by/4.0
Since the birth of Zeus family malwares, they have been sharpening their edge. Zloader is one of the active variants among Zeus family malwares. In December 2019, Zloader revived as “Silent Night.” It communicates with C&C servers using DGA (Domain Generation Algorithm), because changing C&C servers’ domain names can bypass malware detection systems. As a result, it makes it easier to steal information from infected hosts. This study proposes a system that traces Zloader’s C&C servers automatically. This system collects samples, analyzes configuration data, and calculates DGA domains. Moreover, the system collects log files that store information about the infected hosts on the attackers’ servers. The system can not only generate threat intelligence about Zloader for SOC and CSIRT but also follow the trend of attack campaigns. Furthermore, we will discuss how attackers acquire the DGA domains tactically.
Copyright (c) 2024 Yuta Sawabe, Ryuichi Tanabe, Fumio Ozawa, Rintaro Koike (Author) https://creativecommons.org/licenses/by/4.0
DeStroid – Fighting String Encryption in Android Malware
String encryption is a popular technique to obfuscate the functionality, inner workings, and goals of Android apps. Especially malicious apps use this technique to thwart automatic and manual analyses. Typically, a human analyst has to manually identify the decryption routines and afterwards use these routines to decrypt the strings contained in an app. This is a time-consuming and tedious task. What is more, it has to be carried out potentially for every new malware version as the authors frequently modify their techniques. We analyzed the Android malware corpus of Malpedia [1] and found that string encryption is used in more than half of the samples. This demonstrates that string encryption is still a prevailing obfuscation method nowadays. In this paper we present DeStroid, an approach to fully automatically decrypt obfuscated strings from Android apps. We focus in particular on current Android malware using advanced string encryption techniques and show that DeStroid outperforms all publicly available string deobfuscation approaches.
Copyright (c) 2019 Daniel Baier, Martin Lambertz (Author) https://creativecommons.org/licenses/by/4.0
An Overview of the Botnet Simulation Framework
Conducting research on botnets is oftentimes limited to the analysis of active botnets. This prevents researchers from testing detection and tracking mechanisms on potential future threats. Specifically, in the domain of P2P botnets, the protocol specifics, network churn and anti-tracking mechanisms greatly impact the success or failure of monitoring operations. Moreover, experiments on real world botnets, commonly lack ground truth to verify the findings. As developing and deploying botnets of sufficient size is accompanied by large costs and administration efforts, this paper attempts to address this issue by introducing a simulation framework for P2P botnets called Botnet Simulation Framework (BSF). BSF can simulate monitoring operations in botnets of more than 20.000 bots to evaluate tracking mechanisms or simulate takedown efforts. Moreover, communication traces can be exported to inject traffic into arbitrary PCAP files for training and evaluation of intrusion detection systems.
Copyright (c) 2020 Leon Böck, Shankar Karuppayah, Max Mühlhäuser, Emmanouil Vasilomanolakis (Author) https://creativecommons.org/licenses/by/4.0
YARA-Signator: Automated Generation of Code-based YARA Rules
Effective detection and identification signatures are an important component in the toolkit for malware analysis. The creation of such signatures is still widely a manual task that requires notable experience and knowledge on the side of analysts. In this paper, we present YARA-Signator, an approach for the automated generation of code-based YARA rules. The method is based on the isolation of instruction n-grams that on the one hand appear frequently within a malware family and on the other hand are not found in any other family. Applying YARA-Signator to the Malpedia data set, we show that in fact on average 51.85% of the instruction n-grams of length 4 and higher are only found in the respective family. The rules produced by the system using this data set achieve an overall F1 score of 0.983 and cause only very few false positives in a sanity check against a large goodware data set. YARASignator is made available as open source and a periodically updated reference rule set is provided for free through Malpedia.
Copyright (c) 2019 Felix Bilstein, Daniel Plohmann (Author) https://creativecommons.org/licenses/by/4.0
Collecting Malicious Particles from Neutrino Botnets
Neutrino Bot (also known and detected as Win/Kasidet) is a rapidly changing threat. It first became known around December 2013. It has been actively developed ever since resulting in version 5.4 at the very beginning of 2018. It is being sold for an attractive price to a large variety of cybercriminals. This paper shows an extensive summary of the history of the bot while focusing on the most recent versions. It presents methods how to analyse Neutrino botnets and provides key findings that have been discovered during the year 2018.
Copyright (c) 2018 Jakub Souček, Jakub Tomanek, Peter Kálnai (Author) https://creativecommons.org/licenses/by/4.0
ApiScout: Robust Windows API Usage Recovery for Malware Characterization and Similarity Analysis
Given today's masses of malware there is a need for fast analysis and comparison of samples. System API usage has been proven to be a very valuable source of information for this e.g. shown by Rieck et al. However, the majority of malware samples is shipped packed, making it hard to get accurate information on their payload's API usage. Today's state of the art to get this information from packed samples is by unpacking them or dumping memory with subsequent reconstruction of imports using tools like ImpREC and Scylla. This has several drawbacks since it is a manual procedure requiring a live process environment and suffers from inaccuracy due to missed dynamic imports. In this paper, we present ApiScout, a fully automated method to recover API usage information from memory dumps. It does not require a live process environment and is capable of handling dynamic imports leading to more accurate results compared to existing approaches. ApiScout is a two-staged approach. The first stage is a preparation step creating a database of candidate offsets for API functions. In the second step we crawl through a given memory dump of a process and match all possible DWORDs and QWORDs against this database yielding us API reference candidates. We filter and enrich candidates using different procedures leading us to the desired API usage information. Based on this information, our second contribution in this paper is a concept called ApiVectors. It efficiently stores the information extracted by ApiScout. This enables fast assessment of a malware's potential capabilities and allows similarity analysis of API usage across samples. For the latter the methods imphash and impfuzzy are the de facto standard. However, they both suffer from inaccuracy due to exclusively relying on the import table and non-recoverability of input data. In our approach we use Jaccard and Tanimoto similarity to compare ApiVectors, leading to a much higher accuracy. Our third contribution is an extensive analysis of API usage across 589 malware families of the Malpedia dataset. The families combined use only about 4500 APIs that can be grouped into 12 semantic groups. The analysis further proves the functionality of ApiScout and shows that ApiVectors clearly outperform imphash and impfuzzy.
Copyright (c) 2018 Daniel Plohmann, Steffen Enders, Elmar Padilla (Author) https://creativecommons.org/licenses/by/4.0
An Overview of the WCMS Brute-forcing Malware Landscape
Web Content Management Systems (WCMS) provide simple tools to manage web content that enables users with little knowledge of programming languages and web design. WCMSs have become extremely popular in the last decade. WordPress, with more than 18M websites world wide, is the most prominent WCMS. Is because of its popularity that this and other well-known WCMSs have been systematically attacked for the past years by different threat actors seeking disposable infrastructure for their attacks. Brute-force attacks are one of the most common types of attacks against WCMSs. The goal of such an attack is to guess a valid user name and password in order to access the WCMS administration panel. Attackers especially take advantage of users choosing weak credentials. Successfully brute-forced websites are typically used for hosting C\&Cs, scams, and drive-by attacks to spread malware. This paper presents an historical overview and current state of WCMS brute-force attacks with a focus on botnets and techniques used. We present a case of study of Sathurbot, a modular HTTP-based botnet. Finally, we discuss detection methods to identify these type of attacks.
Copyright (c) 2024 Anna Shirokova, Veronica Valeros (Author) https://creativecommons.org/licenses/by/4.0
Malpedia: A Collaborative Effort to Inventorize the Malware Landscape
For more than a decade now, a perpetual influx of new malware samples can be observed. To analyze this flood effectively, static analysis is still one of the most important methods. Thus, it would be highly desirable to have an open, freely accessible, curated, and cleanly labeled corpus of unpacked malware samples for research on static analysis methods. In this paper, we introduce MALPEDIA, a collaboration platform for curating a malware corpus. Additionally, we provide a baseline for a cleanly labeled malware corpus consisting of 607 families divided into 1792 samples. This corpus offers a plethora of possibilities for researchers, including using it as a testbed for evaluations on detection and analysis methods, quality assurance for classification, and contextualization of new malware. To ensure the quality of our corpus, we adapted the requirements by Rossow et al., derive specific requirements for the context of static malware analysis, and evaluate our corpus against them. Based on our corpus, we show that looking beyond packers dramatically reduces the size needed for a corpus to be representative, as the number of distinct malware families and versions after unpacking is orders of magnitude smaller than the number of unique packed samples. Additionally, we perform a comprehensive study of the Windows malware in the corpus, scrutinizing its structural features. This analysis clearly illustrates that MALPEDIA offers a wealth of information, readily available for in-depth investigations.
Copyright (c) 2024 Daniel Plohmann, Martin Clauß, Steffen Enders, Elmar Padilla (Author) https://creativecommons.org/licenses/by/4.0
Exploring a P2P Transient Botnet - From Discovery to Enumeration
From DDoS attacks to malicious code propagation, Botnets continue to represent a strength threat to entities and users connected to the Internet and, due to this, continue to be an important research area. The power of those numerous networks proved us its power when they interrupted great part of the Internet causing impacts to companies like Twitter and Netflix when Mirai P2P Botnet targeted Dyn company’s DNS services back in 2016. In this paper, we present the study that allowed us to find out a “Mirai-like botnet called Rakos - from our high interactivity honeypot recruitment to the detailed analysis and exploitation of this botnet C&C protocol using crawling and node-injection methods to enumerate and estimate its size. Our contribution includes also a comparison between two P2P botnet exploration methods used in our research and in which situations they may be better suitable in further analysis. Additionally, we propose the term “transient to designate botnets formed by malware that does not use persistence on the compromised system as this tends to be usual amongst modern threats to IoT (Internet of Things) devices.
Copyright (c) 2024 Renato Marinho, Raimir Holanda (Author) https://creativecommons.org/licenses/by/4.0
ISFB is also known as Gozi2/Ursnif, sometimes Rovnix. ISFB reappeared in early 2013 attracting some attention from the research community and a lot of confusion in the naming convention and to what was being analyzed. Then suddenly, it went dark again. However, dark does not mean dead. With attention of the world focused on Dridex and Dyre, ISFB silently evolved, hiding from the spotlight to become one of the most complex and fully featured banking trojans out there In this paper, we break the silence surrounding ISFB, giving a full description of this malware capabilities which are beyond those of the average banking trojan: 4 ways of communicating with the CC, half a dozen tricks to steal your money, the ability to create movies of your activity and naturally numerous ways of manipulating your web traffic.
Copyright (c) 2017 Maciej Kotowicz (Author) https://creativecommons.org/licenses/by/4.0
Function Identification and Recovery Signature Tool
Reverse Engineering benign or malicious samples can take a considerable amount of time and new samples are created at an alarming rate. Leveraging disassemblers, like IDA Pro, a reverse engineer can analyze the same routines across several samples over the lifetime of their career. Their knowledge is not easily transferred to similar samples or functions for themselves or others. In particular we can consider the problem code reuse has on reversing efforts, whether it is via statically-linked libraries or integrating existing software. In this paper we want to provide a solution for transferring knowledge to similar functions by introducing a new reverse engineering tool, named FIRST (Function Identification and Recovery Signature Tool), to reduce analysis time and enable information sharing.
Copyright (c) 2017 Angel M. Villegas (Author) https://creativecommons.org/licenses/by/4.0
DGA Clustering and Analysis: Mastering Modern, Evolving Threats, DGALab
Domain Generation Algorithms (DGA) is a basic building block used in almost all modern malware. Malware researchers have attempted to tackle the DGA problem with various tools and techniques, with varying degrees of success. We present a complex solution to populate DGA feed using reversed DGAs, third-party feeds, and a smart DGA extraction and clustering based on emulation of a large number of samples. Smart DGA extraction requires no reverse engineering and works regardless of the DGA type or initialization vector, while enabling a cluster-based analysis. Our method also automatically allows analysis of the whole malware family, specific campaign, etc. We present our system and demonstrate its abilities on more than 20 malware families. This includes showing connections between different campaigns, as well as comparing results. Most importantly, we discuss how to utilize the outcome of the analysis to create smarter protections against similar malware.
Copyright (c) 2015 Alexander Chailytko, Aliaksandr Trafimchuk (Author) https://creativecommons.org/licenses/by/4.0
Behavior-Driven Development in Malware Analysis
A daily task of malware analysts is the extraction of behaviors from malicious binaries. Such behaviors include domain generation algorithms, cryptographic algorithms or deinstallation routines. Ideally, this tedious task should be automated. So far scientific solutions have not gotten beyond proof-of-concepts. Malware analysts continue to reimplement behaviors of interest manually. However, often times they merely translate the malicious binary assembler code to a higher-level language. This yields to poorly readable and undocumented code whose correctness is not ensured. Furthermore, the current process that malware analysts are following leads to a suboptimal focusing since they deal with too much binary code at once. In this paper, we aim at overcoming these shortcomings by improving the malware analysis process regarding the reimplementation of malicious behaviors. We achieve this by integrating Behavior-Driven Development in the malware analysis process. We explain in detail how the integration of Behavior-Driven Development into the malware analysis process can be done. In a case study on the highly obfuscated malware Nymaim, we show the feasibility of our approach.
Copyright (c) 2015 Thomas Barabosch, Elmar Gerhards-Padilla (Author) https://creativecommons.org/licenses/by/4.0
Building a Hybrid Experimental Platform for Mobile Botnet Research
Mobile botnets are an emerging security threat that aims at exploiting the wide penetration of mobile devices and systems and their vulnerabilities in the same spirit of traditional botnets. Mobile botmasters take advantage of infected mobile devices and issue command and control operations on them to extract personal information, cause denial of service or gain financially. To date, research on countering such attacks or studying their effects has been conducted in a sporadic manner that hinders the repetition of experiments and thus limits their validity. We present here our work on a hybrid experimental platform for mobile botnets that supports the execution and monitoring of related scenarios concerning their infection, attack vectors, propagation, etc. The platform is based on principles of flexibility, extensibility and facilitates the setup of scalable experiments utilising both real and emulated mobile systems. We also discuss a novel method of estimating the active bot population in a botnet and illustrate its deployment on the experimental platform.
Copyright (c) 2015 Apostolos Malatras, Laurent Beslay (Author) https://creativecommons.org/licenses/by/4.0
Practical Experiences of Building an IPFIX Based Open Source Botnet Detector
The academic study of flow-based malware detection has primarily focused on NetFlow v5 and v9. In 2013 IPFIX was ratified as the flow export standard. As part of a larger project to develop protection methods for Cloud Service Providers from botnet threats, this paper considers the challenges involved in designing an open source IPFIX based botnet detection function. This paper describes how these challenges were overcome and presents an open source system built upon Xen hypervisor and Open vSwitch that is able to display botnet traffic within Cloud Service Provider-style virtualised environments. The system utilises Euler property graphs to display suspect “botnestsâ€. The conceptual framework presented provides a vendor-neutral, real-time detection mechanism for monitoring botnet communication traffic within cloud architectures and the Internet of Things.
Copyright (c) 2015 Mark Graham, Adrian Winckles, Erika Sanchez-Velazquez (Author) https://creativecommons.org/licenses/by/4.0