MAIT: Malware Analysis and Intelligence Tool

Abstract

Malware is the instrument that delivers the decisive blow in cyber-attacks. A first-time presented malware or an updated malware can remain undetected and stealth until the attackers achieve their objectives. Information about malware and its use needs to be shared with other entities that are protecting their infrastructure from the same or similar threats. Malware intelligence can be critical in a rapidly changing threat landscape, allowing entities to respond to incidents in a successful and timely manner. We introduce the Malware Analysis and Intelligence Tool, a tool that uses state-of-the-art malware analysers (static and dynamic), combined with open-source malware databases to provide a malware signature and an intelligence report that is collected from publicly available cyber threat intelligence sources. The tool can be used to obtain chronological data for a malicious file, related vulnerabilities, and towards providing attribution and techniques, tactics and procedures when used in attacks from Advanced Persistent Threat groups.

Bridging the Gap: A Survey and Classification of Research-Informed Ethical Hacking Tools

“…Attacks & Defences: Adversarial Behaviours Cairis [60], ESASCF [73], ESSecA [75], HARMer [81], Lore [87], MAL [91], PenQuest [112], PenQuest [112], SVED [133], TAMELESS [134] Attacks & Defences: Malware & Attack Technology: Malware Analysis: Analysis Techniques: Static Analysis/Dynamic Analysis MAIT [90] Human, Organisational & Regulatory Aspects: Human Factors…”

“…MAIT (2021, Yucel et al [90]) (Malware Analysis and Intelligence Tool) utilises state-of-the-art static and dynamic malware analysers alongside open-source malware databases to generate malware signatures and intelligence reports. The tool offers chronological data for malicious files, revealing related vulnerabilities and providing insights into attribution, techniques, tactics, and procedures employed by Advanced Persistent Threat groups in attacks.…”

A Cost-Efficient Threat Intelligence Platform Powered by Crowdsourced OSINT

“…CTI greatly benefits security staff and IT managers in various aspects, including incident avoidance and mitigation, prioritisation of vulnerability management, implementation of proactive countermeasures against emerging threats, and the development of case studies for internal use [9]. Moreover, organisations may share CTI amongst each other, developing a "herd immunity" against common threats [10]. Having a collaborative intelligence sharing platform allows for new threats to be more quickly identified, and for effective responses to be coordinated throughout the community [11].…”

“…Several research studies have used MalwareBazaar to great benefit. When developing the Malware Analysis and Intelligence Tool (MAIT), Yucel et al [10] used the MalwareBazaar API to retrieve advanced persistent threats (APTs) associated with particular malware samples, and to determine when the samples were first identified and uploaded to the MalwareBazaar database. This allows MAIT to produce detailed CTI reports for submitted malware samples, including information such as associated APT actors and first seen dates.…”