System and method for detecting and classifying malware
A network device may include a memory and one or more processors configured to analyze execution of suspicious data; detect one or more states of execution of the suspicious data; determine that the one or more states of execution are to be assigned a priority level; and extract at least a portion of the suspicious data from one or more locations based on determining that the one or more states of execution are to be assigned a priority level.
1. A method comprising:
detecting, by a device, one or more states of execution of suspicious data,
the one or more states of execution indicating that at least a portion of the suspicious data is unpacked in a memory of the device, and
at least another portion of the suspicious data remains packed; and
extracting, by the device and from the memory, the portion of the suspicious data that is unpacked based on a priority level.
2. The method of claim 1 , further comprising:
storing a priority list identifying the one or more states of execution,
wherein the priority list includes information for detecting a state of execution, of the one or more states of execution, or a series of the one or more states of execution that indicates the portion of the suspicious data that is unpacked.
3. The method of claim 1 , wherein detecting the one or more states of execution comprises:
detecting an application programming interface (API) call and one or more parameters passed in the API call.
4. The method of claim 1 , wherein the one or more states of execution includes one or more of:
an application programming interface (API) call,
a parameter passed to an API,
a stateful condition, or
a non-stateful condition.
5. The method of claim 1 , further comprising:
analyzing one or more strings associated with the extracted portion of the suspicious data.
6. The method of claim 1 , further comprising:
classifying the extracted portion of the suspicious data according to one or more of a blacklist or whitelist.
7. The method of claim 1 , further comprising:
updating a priority list with additional information based on the extracted portion.
8. A device, comprising:
a memory; and
one or more processors are to:
detect one or more states of execution of suspicious data,
the one or more states of execution indicating that at least a portion of the suspicious data is unpacked in a location of the memory of the device, and
at least another portion of the suspicious data remains packed; and
extract, from the location in the memory, the portion of the suspicious data that is unpacked based on a priority level.
9. The device of claim 8 , wherein the suspicious data comprises a malware executable.
10. The device of claim 8 , wherein the one or more processors are further to:
store a priority list identifying the one or more states of execution,
wherein the priority list includes information for detecting a series of the one or more states of execution that indicates the portion of the suspicious data that is unpacked.
11. The device of claim 8 , wherein the one or more processors, to detect the one or more states of execution, are to:
detect an application programming interface (API) call and one or more parameters passed in the API call.
12. The device of claim 8 , wherein the one or more states of execution includes one or more of:
a stateful condition, or
a non-stateful condition.
13. The device of claim 8 , wherein the one or more processors are further to:
analyze one or more strings related to the extracted portion of the suspicious data.
14. The device of claim 8 , wherein the one or more processors are further to:
classify the extracted portion of the suspicious data; and
update a priority list with additional information based on the classified extracted portion.
15. A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the one or more processors to:
detect a state of execution of suspicious data,
the state of execution indicating that at least a portion of the suspicious data is unpacked in a memory of the device, and
at least another portion of the suspicious data remains packed; and
extract, from the memory, the portion of the suspicious data that is unpacked based on a priority level.
16. The non-transitory computer-readable medium of claim 15 , wherein the memory is virtual memory.
17. The non-transitory computer-readable medium of claim 15 , wherein the state of execution includes:
an application programming interface (API) call, or
a parameter passed to an API.
18. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, that cause the one or more processors to detect the state of execution, cause the one or more processors to:
detect an application programming interface (API) call and one or more parameters passed in the API call.
19. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
analyze one or more strings related to the extracted portion of the suspicious data.
20. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
classify the extracted portion of the suspicious data according to one or more of a blacklist or whitelist.