Systems and methods for detecting geolocation-aware malware
View Patent ↗The disclosed computer-implemented method for detecting geolocation-aware malware may include (1) receiving, by a computing device, trajectory information for network traffic carrying geolocation-aware malware, (2) identifying, from the trajectory information, a target geolocation characteristic required to activate the geolocation-aware malware, (3) establishing, on an image of a user machine, an execution environment having the target geolocation characteristic, (4) running, on the image of the user machine, the geolocation-aware malware, and (5) analyzing functioning of the geolocation-aware malware to identify malicious activity by the geolocation-aware malware. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for detecting geolocation-aware malware, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
receiving, by the computing device, trajectory information for network traffic carrying the geolocation-aware malware, wherein the trajectory information comprises paths intended to be taken by the network traffic carrying the geolocation-aware malware;
identifying, from the trajectory information, a target geolocation characteristic required to activate the geolocation-aware malware;
establishing, on an image of a user machine, an execution environment having the target geolocation characteristic;
running, on the image of the user machine, the geolocation-aware malware; and
analyzing functioning of the geolocation-aware malware to identify malicious activity by the geolocation-aware malware.
2. The method of claim 1 , wherein the trajectory information is received from an advanced threat protection platform.
3. The method of claim 1 , wherein the trajectory information includes at least one of:
a location of an advanced threat protection platform from which the trajectory information is received;
a source of the network traffic; and
a destination of the network traffic.
4. The method of claim 1 , further comprising:
receiving, from an advanced threat protection platform, information describing at least one of:
location-specific hardware of a target of the network traffic; and
location-specific software of the target of the network traffic; and
identifying the target geolocation characteristic from the information describing at least one of:
the location-specific hardware of the target of the network traffic; and
the location-specific software of the target of the network traffic.
5. The method of claim 1 , further comprising:
receiving, from an advanced threat protection platform, information describing at least one of:
a language setting of an operating system of a target machine; and
a keyboard language of the target machine; and
identifying the target geolocation characteristic from the information describing at least one of:
the language setting of the operating system of the target machine; and
the keyboard language of the target machine.
6. The method of claim 1 , wherein running the geolocation-aware malware further includes:
receiving a request, from the geolocation-aware malware, for geolocation-related information about a target machine; and
providing, to the geolocation-aware malware, a falsified network response indicating the geolocation-related information about the target machine.
7. The method of claim 1 , wherein running the geolocation-aware malware further includes:
receiving a request, from the geolocation-aware malware, for an application program interface (API) response indicating geolocation-related information; and
providing, to the geolocation-aware malware, a falsified API response indicating the geolocation-related information.
8. The method of claim 1 , further comprising determining, using the identified malicious activity as a basis, at least one of:
a signature of the geolocation-aware malware;
a verdict that the geolocation-aware malware is not safe to run on a target machine; and
a reputation of the geolocation-aware malware.
9. The method of claim 1 , further comprising performing at least one security action in response to identifying malicious activity by the geolocation-aware malware.
10. The method of claim 1 , further comprising:
receiving information describing a time zone of the target machine; and
identifying the target geolocation characteristic from the information describing the time zone of the target machine.
11. A system for detecting geolocation-aware malware, the system comprising:
a memory device;
a receiving module, stored in the memory device, that receives trajectory information for network traffic carrying the geolocation-aware malware, wherein the trajectory information comprises paths intended to be taken by the network traffic carrying the geolocation-aware malware;
an identifying module, stored in the memory device, that identifies, from the trajectory information, a target geolocation characteristic required to activate the geolocation-aware malware;
an establishing module, stored in the memory device, that establishes, on an image of a user machine, an execution environment having the target geolocation characteristic;
a running module, stored in the memory device, that runs the geolocation-aware malware on the image of the user machine;
an analyzing module, stored in the memory device, that analyzes functioning of the geolocation-aware malware to identify malicious activity by the geolocation-aware malware; and
at least one physical processor that executes the receiving module, the identifying module, the establishing module, the running module, and the analyzing module.
12. The system of claim 11 , wherein the trajectory information is received from an advanced threat protection platform.
13. The system of claim 11 , wherein the trajectory information includes at least one of:
a location of an advanced threat protection platform from which the trajectory information is received;
a source of the network traffic; and
a destination of the network traffic.
14. The system of claim 11 , wherein the receiving module receives, from an advanced threat protection platform, information describing at least one of:
location-specific hardware of a target of the network traffic; and
location-specific software of the target of the network traffic; and
the identifying module identifies the target geolocation characteristic from the information describing at least one of:
the location-specific hardware of the target of the network traffic; and
the location-specific software of the target of the network traffic.
15. The system of claim 11 , wherein the receiving module receives, from an advanced threat protection platform, information describing at least one of:
a language setting of an operating system of a target machine;
a keyboard language of the target machine; and
the identifying module identifies the target geolocation characteristic from the information describing at least one of:
the language setting of the operating system of the target machine; and
the keyboard language of the target machine.
16. The system of claim 11 , wherein running the geolocation-aware malware further includes:
receiving a request, from the geolocation-aware malware, for geolocation-related information about a target machine; and
providing, to the geolocation-aware malware, a falsified network response indicating the geolocation-related information about the target machine.
17. The system of claim 11 , wherein running the geolocation-aware malware further includes:
receiving a request, from the geolocation-aware malware, for an application program interface (API) response indicating geolocation-related information; and
providing, to the geolocation-aware malware, a falsified API response indicating the geolocation-related information.
18. The system of claim 11 , further comprising a determining module, stored in the memory device, that determines, using the identified malicious activity as a basis, at least one of:
a signature of the geolocation-aware malware;
a verdict that the geolocation-aware malware is not safe to run on a target machine; and
a reputation of the geolocation-aware malware.
19. The system of claim 11 , further comprising a performing module, stored in the memory device, that performs at least one security action in response to identifying malicious activity by the geolocation-aware malware.
20. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
receive trajectory information for network traffic carrying geolocation-aware malware, wherein the trajectory information comprises paths intended to be taken by the network traffic carrying the geolocation-aware malware;
identify, from the trajectory information, a target geolocation characteristic required to activate the geolocation-aware malware;
establish, on an image of a user machine, an execution environment having the target geolocation characteristic;
run, on the image of the user machine, the geolocation-aware malware; and
analyze functioning of the geolocation-aware malware to identify malicious activity by the geolocation-aware malware.
21. The non-transitory computer-readable medium of claim 20 , wherein the trajectory information includes at least one of:
a location of an advanced threat protection platform from which the trajectory information is received;
a source of the network traffic; and
a destination of the network traffic.