System and method for automation of malware unpacking and analysis
An information handling system includes a storage and a processor. The storage is configured to store malware samples and malware signatures. The processor is configured to unpack a malware sample, compare the malware sample to known malware families, extract a command-and-control domain, extract encryption keys and communication parameters, store a malware signature for the malware sample, the malware signature including information required to monitor a network for activity of the malware sample or detect the malware sample on another system, and provide the command-and-control server addresses, encryption keys, and communication parameters to a botnet tracker.
1. An information handling system comprising:
a storage configured to store malware samples and malware signatures; and
a processor configured to:
unpack a malware sample;
check for obscurities in the unpacked malware sample, wherein the obscurities include additional packed executable components;
in response to no obscurities being within the unpacked malware sample, compare the malware sample to known malware families including comparing the use of application program interface usage patterns;
extract a command-and-control domain;
extract encryption keys and communication parameters;
store a malware signature for the malware sample, the malware signature including information required to monitor a network for activity of the malware sample or detect the malware sample on another system; and
provide the command-and-control server addresses, encryption keys, and communication parameters to a botnet tracker.
2. The information handling system of claim 1 , wherein the communication parameters include a campaign identifier, a botnet identifier, a request format, or any combination thereof.
3. The information handling system of claim 1 , wherein the command-and control domain includes a list of command-and-control addresses, a domain generation algorithm and seed, or any combination thereof.
4. The information handling system of claim 1 , wherein comparing the malware sample to known malware families includes comparing an opcode pattern.
5. The information handling system of claim 1 , wherein comparing the malware sample to known malware families includes comparing a regular expression pattern.
6. The information handling system of claim 1 , wherein comparing the malware sample to known malware families includes comparing a mutex.
7. A method for automated malware analysis, comprising:
obtaining a malware sample;
unpacking the malware sample;
checking for obscurities in the unpacked malware sample, wherein the obscurities include additional packed executable components;
in response to no obscurities being within the unpacked malware sample, comparing the malware sample to known malware families including comparing the use of application program interface usage patterns;
extracting a command-and-control domain from the unpacked malware sample;
extracting encryption keys and communication parameters from the unpacked malware sample;
storing a malware signature for the malware sample, the malware signature including information required to monitor a network for activity of the malware sample or detect the malware sample on a system; and
providing the command-and-control server addresses, encryption keys, and communication parameters to a botnet tracker.
8. The method of claim 7 , wherein the communication parameters include a campaign identifier, a botnet identifier, a request format, or any combination thereof.
9. The method of claim 7 , wherein the command-and control domain includes a list of command-and-control addresses, a domain generation algorithm and seed, or any combination thereof.
10. The method of claim 7 , wherein comparing the malware sample to known malware families includes comparing an opcode pattern or a regular expression pattern.
11. The method of claim 7 , wherein comparing the malware sample to known malware families includes comparing a mutex.
12. A non-transitory computer-readable medium including code that when executed by a processor causes the processor to perform a method, the method comprising:
obtaining a malware sample;
unpacking the malware sample;
checking for obscurities in the unpacked malware sample, wherein the obscurities include additional packed executable components;
in response to no obscurities being within the unpacked malware sample, comparing the malware sample to known malware families including comparing the use of application program interface usage patterns;
extracting a command-and-control domain from the unpacked malware sample;
extracting encryption keys and communication parameters from the unpacked malware sample;
storing a malware signature for the malware sample, the malware signature including information required to monitor a network for activity of the malware sample or detect the malware sample on a system; and
providing the command-and-control server addresses, encryption keys, and communication parameters to a botnet tracker.
13. The non-transitory computer-readable medium of claim 12 , wherein the communication parameters include a campaign identifier, a botnet identifier, a request format, or any combination thereof.
14. The non-transitory computer-readable medium of claim 12 , wherein the command-and control domain includes a list of command-and-control addresses, a domain generation algorithm and seed, or any combination thereof.
15. The non-transitory computer-readable medium of claim 12 , wherein comparing the malware sample to known malware families includes comparing an opcode pattern.
16. The non-transitory computer-readable medium of claim 12 , wherein comparing the malware sample to known malware families includes comparing a regular expression pattern.
17. The non-transitory computer-readable medium of claim 12 , wherein comparing the malware sample to known malware families includes comparing a mutex.