Malware dropper discovery method and system
View Patent ↗A process for finding potentially harmful malware dropper on an infected computer system includes the steps of a) identifying an executable file that is about to run, and b) providing a storage agent that stores a copy of said executable file for a later inspection.
1. A method for facilitating finding a potentially harmful malware dropper on a computer system, comprising the steps of:
a) identifying an executable file upon execution of said executable file on a computer;
b) storing, responsive to identifying said executable file upon execution of said executable file on said computer, a copy of said executable file in a database; and
c) inspecting said copy of said executable file responsive to detecting malware on said computer and subsequent to said executable file deleting said executable file from said computer,
wherein the identifying and storing are embodied in computer-readable instructions stored on a computer-readable medium for execution by a computer processor.
2. The method of claim 1 , wherein the database is adapted to be accessed from a remote location.
3. A method according to claim 1 , further comprising maintaining a white list of legitimate executable files.
4. A method according to claim 1 , further comprising recording threads initiated by the process of the executable file.
5. A method according to claim 1 , wherein the identifying comprises checking a cryptographic hash algorithm of the executable file to determine whether said executable file has previously run on said computer.
6. A method according to claim 1 , wherein the storing is performed if it appears that the executable file is running for the first time on said computer.
7. A method according to claim 1 , wherein the storing is performed after subjecting said executable file to one or more filtering rules, and only if one or more of said rules are met.
8. A system, comprising:
a) at least one processor; and
b) a memory comprising computer-readable instructions which when executed by the at least one processor causes the processor to execute a storage agent, wherein the storage agent:
identifies an executable file upon execution of said executable file on a computer;
stores, responsive to identifying said executable file upon execution of said executable file on said computer, a copy of said executable in a database; and
inspects said copy of said executable file responsive to detecting malware on said computer and subsequent to said executable file deleting said executable file from said computer.
9. A non-transitory computer-readable medium comprising instructions which when executed by at least one processor causes the processor to perform the method of claim 1 .
10. A storage agent configured to:
identify an executable file upon execution of said executable file on a computer,
store, responsive to identifying said executable file upon execution of said executable file on said computer, a copy of said executable file in a database, and
inspect said copy of said executable file responsive to detecting malware on said computer and subsequent to said executable file deleting said executable file from said computer.
11. The method of claim 1 wherein the identifying comprises hooking a kernel-based create process function of the computer.
12. The method of claim 1 wherein the identifying comprises hooking a user space-based create process function of the computer.