Systems and methods for protecting a computing device against malicious code

1. A computer implemented method of vaccination of a computing device against infection by malicious code, comprising:

obtaining from a server over a network a vaccination profile documenting a plurality of vaccination artifact system calls performed by a malicious code attempting to identify another instance of the malicious code executing on the computing device prior to the malicious code infecting the computing device;

monitoring the computing device to detect an indication of execution of at least one of the plurality of vaccination artifact system calls by the malicious code,

wherein the executed at least one of the plurality of vaccination artifact system calls comprises at least one operating system call for acquiring data at the storage level indicating the presence of at least one infection marker in a storage medium of the computing device;

in response to the detected indication, generating a false response indicative of the presence of at least one infection marker in the storage medium of the computing device as an outcome of execution of at least one of the plurality of vaccination artifact system calls by the malicious code,

wherein the false response indicative of the presence of at least one infection marker is generated at the operating system level without executing the at least one operating system call for acquiring data at the storage level; and

providing the false response to the at least one of the plurality of vaccination artifact system calls for emulating an existing infection of the computing device by another instance of the malicious code according to the indication of execution of at least one of the plurality of vaccination artifact system calls, wherein the emulation of the existing infection prevents infection of the computing device by the malicious code.

2. The method according to claim 1 , further comprising removing the another instance of the malicious code from the computing device according to a process initiating the at least one of the plurality of vaccination artifact system calls.

3. The method according to claim 1 , wherein a first signature of the malicious code is different from a second signature of the another instance of the malicious code, such that an anti-malware program trained to detect the malicious code according to the first signature is unable to detect the another instance of the malicious code according to the first signature.

4. The method according to claim 1 , wherein the at least one vaccination artifact system call comprises operating system queries for detecting the at least one infection marker stored in a storage medium, wherein the at least one infection marker indicates to the malicious code attempting infection that the computing device is already infected by another instance of the malicious code.

5. The method according to claim 4 , wherein the vaccination profile emulates the existing infection by providing false responses to the operating system queries indicating the presence of the at least one infection marker.

6. The method according to claim 4 , wherein the operating system queries for detecting the at least one infection marker are selected from the group consisting of: detecting a predefined mutex stored in memory, detecting a predefined file stored in a data storage device, detecting a predefined key stored in a system registry, and combinations of the aforementioned.

7. The method according to claim 1 , wherein the at least one vaccination artifact system call comprises operating system instructions for storing the at least one infection marker in the storage medium, wherein the at least one infection marker indicates to the malicious code attempting infection that the computing device is already infected by another instance of the malicious code.

8. The method according to claim 7 , wherein the vaccination profile emulates the existing infection by providing false responses indicating the presence of the at least one infection marker in the storage medium to operating system queries issued by the malicious code.

9. The method according to claim 7 , wherein the operating system queries for storing the at least one infection marker are selected from the group comprising: storing a predefined mutex in memory, storing a predefined file in a data storage device, storing a predefined key in a system registry, and combinations of the aforementioned.

10. The method according to claim 1 , wherein the vaccination profile stores a whitelist of records of benign vaccination artifact system calls, wherein when the monitored at least one of the plurality of vaccination artifact system calls matches a record of the whitelist, the at least one of the plurality of vaccination artifact system calls is passed to the operating system for continued execution thereof.

11. The method according to claim 1 , wherein the vaccination profile stores a blacklist of records of malicious vaccination artifact system calls, wherein when the monitored at least one of the plurality of vaccination artifact system calls matches a record of the blacklist, the at least one of the plurality of vaccination artifact system calls is prevented from passing to the operating system for continued execution thereof.

12. The method according to claim 1 , wherein the vaccination profile stores a set of rules for matching patterns of vaccination artifact system calls, and monitoring comprises monitoring the computing device for the indication of execution of the pattern matching to the set of rules for detection of the indication of execution of the at least one of the plurality of vaccination artifact system calls.

13. The method according to claim 1 , wherein monitoring the computing device comprises intercepting an operating system query for detecting the at least one infection marker stored in the storage medium, further comprising analyzing the intercepted operating system query for a matching record stored in the vaccination profile documenting a corresponding vaccination artifact system call, when no matching record is found: identifying an exit and/or termination in response paths related to the corresponding vaccination artifact system call, and returning an exit call to the malicious code when the indication of exit and/or termination is identified.

14. The method according to claim 1 , further comprising:

monitoring the computing device for an indication of execution of a certain system call;

analyzing the certain system call for a matching vaccination artifact of the plurality of vaccination artifact system calls stored in the vaccination profile;

providing the malicious code with a false response to the certain system call when the certain system call does not match any of the plurality of vaccination artifact system calls stored in the vaccination profile, for emulating execution of the certain system call to the malicious code.

15. The method of claim 14 , further comprising:

computing a score indicative of likelihood of malicious activity according to instructions to access resources of the computing device issued by the process that issued the certain system call, and providing the malicious code with the false response when the score is above a threshold indicative of malicious activity.

16. The method according to claim 1 , wherein the another instance of the malicious code comprises another version of the malicious code.

17. The method of claim 1 , wherein the executed at least one of the plurality of vaccination artifact system calls is hooked and prevented from reaching a destination execution process that acquires data at the storage level, and the false response is provided to the executed at least one of the plurality of vaccination artifact system calls faking execution of the destination execution process.

18. The method of claim 1 , wherein the executed at least one of the plurality of vaccination artifact system calls are eavesdropped during processing by a destination execution process that acquires data at the storage level, and a response by the destination execution process to the executed at least one of the plurality of vaccination artifact system calls is hooked, preventing a true response from reaching the malicious code, wherein the false responses is sent to the malicious code instead of the true response.

19. The method of claim 1 , wherein a previous signature of the another instance of the malicious code is different from an updated signature of the malicious code that executes the at least one of the plurality of vaccination artifact system calls.

20. The method of claim 1 , wherein the presence of the at least one infection marker in the storage medium is emulated when the at least one infection marker is not actually stored on the storage medium.

21. A system for vaccination of a computing device against infection by malicious code, comprising:

a non-transitory memory having stored thereon a code for execution by at least one hardware processor, the code comprising:

code for obtaining from at least one server over a network a vaccination profile documenting a plurality of vaccination artifact system calls performed by a malicious code attempting to identify another instance of the malicious code executing on the computing device prior to the malicious code infecting the computing device;

code for monitoring the computing device to detect an indication of execution of at least one of the plurality of vaccination artifact system calls by the malicious code,

wherein the executed at least one of the plurality of vaccination artifact system calls comprises at least one operating system call for acquiring data at the storage level indicating the presence of at least one infection marker in a storage medium of the computing device;

code for generating, in response to the detected indication, a false response indicative of the presence of at least one infection marker in the storage medium of the computing device as an outcome of execution of at least one of the plurality of vaccination artifact system calls by the malicious code,

wherein the false response indicative of the presence of at least one infection marker is generated at the operating system level without executing the at least one operating system call for acquiring data at the storage level; and

code for providing the false response to the at least one of the plurality of vaccination artifact system calls for emulating an existing infection of the computing device by another instance of the malicious code according to the indication of execution of at least one of the plurality of vaccination artifact system calls, wherein the emulation of the existing infection prevents infection of the computing device by the malicious code.

22. A computer program product for vaccination of a computing device against infection by malicious code, comprising:

a non-transitory memory having stored thereon a code for execution by at least one hardware processor, the code comprising:

instructions for obtaining a vaccination profile documenting a plurality of vaccination artifact system calls performed by a malicious code attempting to identify another instance of the malicious code executing on the computing device prior to the malicious code infecting the computing device;

instructions for monitoring the computing device to detect an indication of execution of at least one of the plurality of vaccination artifact system calls by the malicious code,

wherein the executed at least one of the plurality of vaccination artifact system calls comprises at least one operating system call for acquiring data at the storage level indicating the presence of at least one infection marker in a storage medium of the computing device;

instructions for generating, in response to the detected indication, a false response indicative of the presence of at least one infection marker in the storage medium of the computing device as an outcome of execution of at least one of the plurality of vaccination artifact system calls by the malicious code,

wherein the false response indicative of the presence of at least one infection marker is generated at the operating system level without executing the at least one operating system call for acquiring data at the storage level; and

instructions for providing the false response to the at least one of the plurality of vaccination artifact system calls for emulating an existing infection of the computing device by another instance of the malicious code according to the indication of execution of at least one of the plurality of vaccination artifact system calls, wherein the emulation of the existing infection prevents infection of the computing device by the malicious code.