Impeding automated malware analysis with environment-sensitive malware

Authors:
Chengyu Song;Paul Royal;Wenke Lee
Affiliations:
Georgia Institute of Technology;Georgia Institute of Technology;Georgia Institute of Technology
Venue:
HotSec'12 Proceedings of the 7th USENIX conference on Hot Topics in Security
Year:
2012

Citing 13
Cited 1

Jockey: a user-space library for record-replay debugging

Proceedings of the sixth international symposium on Automated analysis-driven debugging
Cobra: Fine-grained Malware Analysis using Stealth Localized-executions

SP '06 Proceedings of the 2006 IEEE Symposium on Security and Privacy
PolyUnpack: Automating the Hidden-Code Extraction of Unpack-Executing Malware

ACSAC '06 Proceedings of the 22nd Annual Computer Security Applications Conference
Behavior-based spyware detection

USENIX-SS'06 Proceedings of the 15th conference on USENIX Security Symposium - Volume 15
Panorama: capturing system-wide information flow for malware detection and analysis

Proceedings of the 14th ACM conference on Computer and communications security
Ether: malware analysis via hardware virtualization extensions

Proceedings of the 15th ACM conference on Computer and communications security
Automatic Reverse Engineering of Malware Emulators

SP '09 Proceedings of the 2009 30th IEEE Symposium on Security and Privacy
Dispatcher: enabling active botnet infiltration using automatic protocol reverse-engineering

Proceedings of the 16th ACM conference on Computer and communications security
Effective and efficient malware detection at the end host

SSYM'09 Proceedings of the 18th conference on USENIX security symposium
A fistful of red-pills: how to automatically generate procedures to detect CPU emulators

WOOT'09 Proceedings of the 3rd USENIX conference on Offensive technologies
Cloaking malware with the trusted platform module

SEC'11 Proceedings of the 20th USENIX conference on Security
Deobfuscation of virtualization-obfuscated software: a semantics-based approach

Proceedings of the 18th ACM conference on Computer and communications security
Allergy attack against automatic signature generation

RAID'06 Proceedings of the 9th international conference on Recent Advances in Intrusion Detection

RopSteg: program steganography with return oriented programming

Proceedings of the 4th ACM conference on Data and application security and privacy

Quantified Score

Hi-index	0.00

Visualization

Abstract

To solve the scalability problem introduced by the exponential growth of malware, numerous automated malware analysis techniques have been developed. Unfortunately, all of these approaches make previously unaddressed assumptions that manifest as weaknesses to the tenability of the automated malware analysis process. To highlight this concern, we developed two obfuscation techniques that make the successful execution of a malware sample dependent on the unique properties of the original host it infects. To reinforce the potential for malware authors to leverage this type of analysis resistance, we discuss the Flashback botnet's use of a similar technique to prevent the automated analysis of its samples.