NDLI: Finding and extracting crypto routines from malware

Content Provider	IEEE Xplore Digital Library
Author	Leder, F. Martini, P. Wichmann, A.
Copyright Year	2009
Description	Author affiliation: Institute of Computer Science IV, University of Bonn, Germany (Leder, F.; Martini, P.; Wichmann, A.)
Abstract	In this paper we present a new approach for identifying the crypto routines in different types of malware. In traditional malware analysis, like sandboxing, network data is examined as seen on the wire or data is collected as it is written to a file. The use of proprietary binary formats, obfuscation, or encryption hides important details, which are necessary for investigating malicious behavior. It is hardly possible to create decryptors just from monitored sandbox data. Our approach not only examines the data when leaving or entering the malware but also correlates it with information from inside the malware. By monitoring the data at I/O interfaces as well as data dependencies our approach automatically reveals the data origin. Knowing the data origin enables an analyst to easily find the crypto functions. Using this approach, we were able to identify the encryption, decryption, and command parser in different malware samples each within minutes. In our evaluation, we present the results for the Kraken command&control protocol encryption and for the file encryption of the Srvcp trojan.
Starting Page	394
Ending Page	401
File Size	308056
Page Count	8
File Format	PDF
ISBN	9781424457373
ISSN	10972641
e-ISBN	9781424457380
DOI	10.1109/PCCC.2009.5403858
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2009-12-14
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Cryptography Data mining Computerized monitoring Protocols Telecommunication traffic Reverse engineering Computer science Wire Decoding Performance analysis
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Libarray of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Malware Behavior Extracting via Maximal Patterns

Finding and extracting crypto routines from malware

Beyond thresholds: an alternative method for extracting information from network measurements

A Methodology for Finding Significant Network Hosts

Key derivation for network management applications

Extracting Information from Unknown Protocols On CampusNet

Effective network monitoring

Concealed Key-Phrase Verification

Identification of Bot Commands by Run-Time Execution Monitoring

Finding and extracting crypto routines from malware

Similar Documents

Malware Behavior Extracting via Maximal Patterns

Finding and extracting crypto routines from malware

Beyond thresholds: an alternative method for extracting information from network measurements

A Methodology for Finding Significant Network Hosts

Key derivation for network management applications

Extracting Information from Unknown Protocols On CampusNet

Effective network monitoring

Concealed Key-Phrase Verification

Identification of Bot Commands by Run-Time Execution Monitoring

Finding and extracting crypto routines from malware