• Home

  • Documents

  • Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service -...
35
Visual Analysis of Malware Behavior October 11th, 2009

Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls

  • Upload
    others

  • View
    7

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls

Visual Analysis of Malware Behavior

October 11th, 2009

Page 2: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls

About Us

• University of Mannheim, Germany

• Laboratory for Dependable Distributed Systems• Security research:

• Analysis of malware and spam• Honeypots / IT-Forensics

Page 3: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls

Motivation

• Sandbox Service - CWSandbox.org

• Dynamic malware analysis • API-Hooking• Monitors 121 API-Calls out of 20 sections• Detailed Behavior Report (XML)

• Up to 4000 new samples per day• Manual processing not possible

Page 4: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls

Motivation

• What are the main Operations?• Network activities?• Registry access?• Filesystem operations? • ...

• Which operations do not occur?•

Page 5: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls

Motivation

• What are the main Operations?• Network activities?• Registry access?• Filesystem operations? • ...

• Which operations do not occur?•

Which samples are of interest?

Page 6: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 7: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 8: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 9: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 10: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls

Visualization

• CWSandbox report is “too” detailed• Use visualization for abstraction• Simple to create• Comprehensible

• Treemaps and Threadgraphs

• Static version (Python, matplotlib)• Dynamic version using JavaScript (flot, Jit)

Page 11: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls

Treemaps

• Quick overview• Displays the distribution of all operations• No information about the sequence of operations

• Use case: Malware clustering

Page 12: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 13: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 14: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 15: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 16: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 17: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 18: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 19: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 20: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 21: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls

Threadgraph

• Detailed view of the monitored behavior• Every monitored operation of all executed threads• Sequential order preserved

• Truncated Reports only (static version)• Zoom necessary (JavaScript)

Page 22: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 23: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 24: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 25: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 26: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 27: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 28: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls

Analysis of malicious PDFs

• Monitor Adobe Acrobat Reader within CWSandbox• Autoupdate disabled

• Short experiment:• 200 benign PDFs• 17 malicious PDFs

• Two different Treemaps• Malicious operations are observable at once

Page 29: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 30: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 31: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 32: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 33: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls
Page 34: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls

Conclusion

• First attempt on visualization - need Feedback• Plots are accessible on CWSandbox.org

• Static + JavaScript version

• Study on image clustering and classification• Development of further visualization types

Page 35: Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service - CWSandbox.org • Dynamic malware analysis • API-Hooking • Monitors 121 API-Calls

Questions?

http://pi1.informatik.uni-mannheim.dehttp://cwsandbox.org

[email protected]

mailto:[email protected]
mailto:[email protected]
http://cwsanbdox.org
http://cwsanbdox.org
mailto:[email protected]
mailto:[email protected]

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Documents
Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Documents
(API) for API hookers: Taking a closer look at malware - APL-UW

(API) for API hookers: Taking a closer look at malware - APL-UW

Documents
MAMADROID: Detecting Android Malware by Building Markov ... · Android malware detection. M AM DROID characterizes the transitions between different API calls performed by Android

MAMADROID: Detecting Android Malware by Building Markov ... · Android malware detection. M AM DROID characterizes the transitions between different API calls performed by Android

Documents
Practical Malware Analysis: Ch 11: Malware Behavior

Practical Malware Analysis: Ch 11: Malware Behavior

Education
Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Documents
Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Documents
Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Documents
Code Cartographer's Diary - pnx.tf fileOverview: Malpedia Motivation & Overview Operationalizing Malpedia Windows API Usage Recovery & Analysis for Malware Characterization Tools:

Code Cartographer's Diary - pnx.tf fileOverview: Malpedia Motivation & Overview Operationalizing Malpedia Windows API Usage Recovery & Analysis for Malware Characterization Tools:

Documents
Official Malware Report - exploit-db.com · 8.1 This malware sample makes a function call to the native Windows API C:\WINDOWS\System32\winsock32.dll which is the Windows Sockets

Official Malware Report - exploit-db.com · 8.1 This malware sample makes a function call to the native Windows API C:\WINDOWS\System32\winsock32.dll which is the Windows Sockets

Documents
Secure Programming Lecture 17: Malware Analysis for ... · Android Architecture Java API Framework: É Components: Activity, Service, Receiver, Content Provider, etc. É Lifecycle:

Secure Programming Lecture 17: Malware Analysis for ... · Android Architecture Java API Framework: É Components: Activity, Service, Receiver, Content Provider, etc. É Lifecycle:

Documents
Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Documents
Windows Malware Firewall: Remove Windows Malware Firewall

Windows Malware Firewall: Remove Windows Malware Firewall

Technology
Visually Guided Flow Tracking in Software-Defined Networkinggraphics.idav.ucdavis.edu/~hamann/PostWischgollBryantHa...2016 IEEE SYMPOSIUM ON VISUALIZATION FOR CYBER SECURITY (VIZSEC)

Visually Guided Flow Tracking in Software-Defined Networkinggraphics.idav.ucdavis.edu/~hamann/PostWischgollBryantHa...2016 IEEE SYMPOSIUM ON VISUALIZATION FOR CYBER SECURITY (VIZSEC)

Documents
Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Documents
MAS: Malware Analysis System Based on Hardware-Assisted ... · Recently, malware analysis methods which utilize virtualization technology are in-troduced such as Win32 API hooking,

MAS: Malware Analysis System Based on Hardware-Assisted ... · Recently, malware analysis methods which utilize virtualization technology are in-troduced such as Win32 API hooking,

Documents
OpenDNS CTO Dan Hubbard VizSec 2014 Keynote Slides

OpenDNS CTO Dan Hubbard VizSec 2014 Keynote Slides

Technology
MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Documents
Intrusion Detection and Malware Analysis - Malware collection

Intrusion Detection and Malware Analysis - Malware collection

Documents
On Malware Leveraging the Android Accessibility Frameworkxinwenfu/paper/Journals/15_UE_1_4...API to its accessibility framework so that developers can integrate accessibility functionality

On Malware Leveraging the Android Accessibility Frameworkxinwenfu/paper/Journals/15_UE_1_4...API to its accessibility framework so that developers can integrate accessibility functionality

Documents
Efficient Android Malware Detection Using API Rank and ...isyou.info › jisis › vol9 › no1 › jisis-2019-vol9-no1-03.pdf · Efficient Android Malware Detection Using API Rank

Efficient Android Malware Detection Using API Rank and ...isyou.info › jisis › vol9 › no1 › jisis-2019-vol9-no1-03.pdf · Efficient Android Malware Detection Using API Rank

Documents
Malware and Anti-Malware Seminar by Benny Czarny

Malware and Anti-Malware Seminar by Benny Czarny

Technology
Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Documents
Towards Network Containment in Malware Analysis Systemss3.eurecom.fr/slides/acsac12_graziano.slides.pdf · 2020-06-17 · Malware Analysis Scenario Analysis based on Sandboxes (API

Towards Network Containment in Malware Analysis Systemss3.eurecom.fr/slides/acsac12_graziano.slides.pdf · 2020-06-17 · Malware Analysis Scenario Analysis based on Sandboxes (API

Documents
Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Documents
AndrEnsemble: Leveraging API Ensembles to …...AndrEnsemble: Leveraging API Ensembles to Characterize Android Malware Families Omid Mirzaeiq, Guillermo Suarez-Tangil , Jose M. de

AndrEnsemble: Leveraging API Ensembles to …...AndrEnsemble: Leveraging API Ensembles to Characterize Android Malware Families Omid Mirzaeiq, Guillermo Suarez-Tangil , Jose M. de

Documents
Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Documents
Malware Characterization UsingWindows API Call Sequences...harshit.sharma@st.niituniversity.in ∗Corresponding Author Received 05April 2017;Accepted 29 June 2018; Publication 27 July

Malware Characterization UsingWindows API Call [email protected] ∗Corresponding Author Received 05April 2017;Accepted 29 June 2018; Publication 27 July

Documents
Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Documents
Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Documents