GoldenEye: Efficiently and Effectively Unveiling Malware’s Targeted Environment

Abstract

Abstract. A critical challenge when combating malware threat is how to efficiently and effectively identify the targeted victim's environment, given an unknown malware sample. Unfortunately, existing malware analysis techniques either use a limited, fixed set of analysis environments (not effective) or employ expensive, time-consuming multi-path exploration (not efficient), making them not well-suited to solve this challenge. As such, this paper proposes a new dynamic analysis scheme to deal with this problem by applying the concept of speculative execution in this new context. Specifically, by providing multiple dynamically created, parallel, and virtual environment spaces, we speculatively execute a malware sample and adaptively switch to the right environment during the analysis. Interestingly, while our approach appears to trade space for speed, we show that it can actually use less memory space and achieve much higher speed than existing schemes. We have implemented a prototype system, GOLDENEYE, and evaluated it with a large real-world malware dataset. The experimental results show that GOLDENEYE outperforms existing solutions and can effectively and efficiently expose malware's targeted environment, thereby speeding up the analysis in the critical battle against the emerging targeted malware threat.

Phantom Malware: Conceal Malicious Actions From Malware Detection Techniques by Imitating User Activity

“…Otherwise, the malware does not do anything harmful. In most cases, it terminates [78]. The following section summarises the two techniques GoldenEye [78] and VECG [79] for detecting the targeted environment of a malware.…”

“…In most cases, it terminates [78]. The following section summarises the two techniques GoldenEye [78] and VECG [79] for detecting the targeted environment of a malware. Further, it is discussed why these techniques failed to identify Phantom Malware's targeted environment.…”

“…Otherwise, the next (starting from this basic block) WinAPI call representing an environmental query will be determined. Thereafter, the complete analysis process starts again [78].…”

Harvesting Runtime Values in Android Applications That Feature Anti-Analysis Techniques

“…HARVESTER instruments the reporting mechanism for the values of interest into the slices (see line 4), making changes to the runtime environment (emulator, Android OS) unnecessary. Note that HARVESTER does not need to reconfigure or reset the actual device or emulator on which the slices are executed which is novel in comparison to other approaches that are based on symbolic or concolic execution [20], [21].…”

Classification and prediction of matrix structured data with applications to recommendation systems, identifying anti-socials and bot-nets

“…There is a vast literature on the problems of detecting [21,71,77], classifying [15,31,39,85] and eradicating botnets [91]. Detection challenges [12] include multiple administrative domains, Internet heterogeneity, botnets that are purely memory-resident [86] lack of ground truth, privacy concerns.…”