Malware discovery method and system
A process for identifying potentially harmful malware, comprises the steps of: a) identifying an executable that is about to run; b) providing a monitoring agent that monitors all threads that are descendent of a thread initiated by the process of said executable; and c) configuring said monitoring agent to conclude that a high probability of malware presence exists, if one of said descendent threads reaches a target process in which suspicious patches are created.
1. A method for identifying potentially harmful malware, comprising the steps of:
a) identifying, on a processor, an executable that is about to run;
b) providing, on the processor, a monitoring agent that monitors
a suspicious process of the executable,
a thread of a legitimate process, initiated by the suspicious process of the executable, and
a descendent thread initiated by the legitimate process,
wherein the monitoring agent
monitors creation of any threads by placing a hook on a thread creation function,
checks from which thread any of the threads originates, and
monitors any of the threads that descend from the suspicious process; and
c) determining, on the processor using the monitoring agent, that a high probability of malware presence exists if a suspicious patch is created in a target process by the descendent thread initiated by the legitimate process.
2. The method of claim 1 , wherein the target process is a browser process.
3. The method of claim 1 , wherein when the monitoring agent identifies an executable that is about to run, the monitoring agent checks a cryptographic hash algorithm to determine whether the executable has run in the at least one processor before.
4. The method of claim 3 , wherein if it appears that the executable is running for the first time, the monitoring agent continues to monitor the executable.
5. The method of claim 3 , wherein the monitoring agent monitors the executable each time the executable runs.
6. The method of claim 3 , wherein the cryptographic hash algorithm is selected from MD5, SHAT and SHA2.
7. The method of claim 1 , wherein the monitoring agent operates in a Windows environment.
8. The method of claim 1 , wherein the executable creates a thread in a legitimate system process.
9. The method of claim 1 , wherein the monitoring agent maintains a listing of at least one legitimate process with a suspicious behavior.
10. The method of claim 1 , further comprising:
d) performing corrective action when the monitoring agent determines that a high probability of malware presence exists.