Malware deterrence using computer environment indicators
A system for inoculating a computer network against malware is described. Specifically, environmental indicators used by anti-analysis and target filtering mechanisms of a malware program may be determined based on analysis within a virtual or physical sandbox environment. The environmental indicators may be sent to computing devices associated with the computing network. The malware program, based on the environmental indicators, may be spoofed to assume that a computing device is associated with an anti-malware system, and/or is a device that is not to be infected. Based on this assumption, the malware program may not execute within the computing device.
1. An apparatus comprising at least one hardware processor and a memory storing computer-readable instructions that, when executed by the at least one hardware processor, cause the apparatus to:
determine an environmental indicator used by a target filtering mechanism associated with a malware program to prevent execution in a sandbox environment, wherein the environmental indicator comprises an indication of a file system structure of the sandbox environment;
determine whether the environmental indicator is within a predetermined percentile of environmental indicators, in a malware database, arranged in a priority order from lowest priority to highest priority, wherein the priority order of the environmental indicators is based on respective quantities of malware programs using the environmental indicators; and
based on determining that the environmental indicator is within the predetermined percentile of the environmental indicators:
generate, based on the environmental indicator, an inoculation message for transmission to one or more computing devices in a computing network, wherein the inoculation message comprises the indication of the file system structure; and
send, to the one or more computing devices, the inoculation message, wherein the inoculation message causes the one or more computing devices to integrate the indication of the file system structure into corresponding computing environments of the one or more computing devices.
2. The apparatus of claim 1 , wherein the computer-readable instructions, when executed by the at least one hardware processor, cause the apparatus to determine the environmental indicator by causing:
determining that the malware program has not executed within the sandbox environment, and
determining that the environmental indicator corresponds to the sandbox environment.
3. The apparatus of claim 1 , wherein the inoculation message further comprises at least one of:
a registry entry in the sandbox environment;
hardware information associated with the sandbox environment; or
combinations thereof.
4. The apparatus of claim 1 , wherein the computer-readable instructions, when executed by the at least one hardware processor, cause the apparatus to:
determine a second environmental indicator used by an anti-analysis mechanism associated with the malware program to prevent execution of the malware program,
wherein the inoculation message comprises the second environmental indicator; and
wherein the inoculation message causes the one or more computing devices to integrate the second environmental indicator into corresponding computing environments of the one or more computing devices.
5. The apparatus of claim 1 , wherein the target filtering mechanism prevents execution of the malware program based on detection of a registry entry indicating a specified keyboard language, and wherein the inoculation message further comprises the registry entry.
6. The apparatus of claim 1 , wherein the inoculation message further comprises a registry entry, and wherein the inoculation message causes the one or more computing devices to add the registry entry to respective system registries of the one or more computing devices.
7. The apparatus of claim 1 , wherein the malware database comprises indications of a plurality of malware programs and associated environmental indicators, wherein the determining the environmental indicator is based on the malware database.
8. The apparatus of claim 1 , wherein the computer-readable instructions, when executed by the at least one hardware processor, cause the apparatus to present a user interface configured to receive user input for at least one of:
modifying the malware database;
selecting the one or more computing devices; or
combination thereof.
9. The apparatus of claim 1 , wherein the computer-readable instructions, when executed by the at least one hardware processor, cause the apparatus to:
receive information indicating that at least a second computing device in the computing network is infected with the malware program, wherein the sending the inoculation message is based on receiving the information.
10. A method at a malware security platform in a computing network, the method comprising:
determining an environmental indicator used by a target filtering mechanism associated with a malware program to prevent execution in a sandbox environment, wherein the environmental indicator comprises an indication of a file system structure of the sandbox environment;
determining whether the environmental indicator is within a predetermined percentile of environmental indicators, in a malware database, arranged in a priority order from lowest priority to highest priority, wherein the priority order of the environmental indicators is based on respective quantities of malware programs using the environmental indicators; and
based on determining that the environmental indicator is within the predetermined percentile of the environmental indicators:
generating, based on the environmental indicator, an inoculation message for transmission to one or more computing devices in the computing network, wherein the inoculation message comprises the indication of the file system structure; and
sending, to the one or more computing devices, the inoculation message, wherein the inoculation message causes the one or more computing devices to integrate the indication of the file system structure into corresponding computing environments of the one or more computing devices.
11. The method of claim 10 , wherein the determining the environmental indicator comprises:
determining that the malware program has not executed within the sandbox environment, and
determining that the environmental indicator corresponds to the sandbox environment.
12. The method of claim 10 , wherein the inoculation message further comprises at least one of:
a registry entry in the sandbox environment;
hardware information associated with the sandbox environment; or
combinations thereof.
13. The method of claim 10 , further comprising:
determine a second environmental indicator used by an anti-analysis mechanism associated with the malware program to prevent execution of the malware program,
wherein the inoculation message comprises the second environmental indicator; and
wherein the inoculation message causes the one or more computing devices to integrate the second environmental indicator into corresponding computing environments of the one or more computing devices.
14. The method of claim 10 , wherein the target filtering mechanism prevents execution of the malware program based on detection of a registry entry indicating a specified keyboard language, and wherein the inoculation message further comprises the registry entry.
15. The method of claim 10 , wherein the inoculation message further comprises a registry entry, and wherein the inoculation message causes the one or more computing devices to add the registry entry to respective system registries of the one or more computing devices.
16. The method of claim 10 , wherein the malware database comprises indications of a plurality of malware programs and associated environmental indicators, wherein the determining the environmental indicator is based on the malware database.
17. The method of claim 10 , further comprising presenting a user interface configured to receive user input for at least one of:
modifying the malware database;
selecting the one or more computing devices; or
combination thereof.
18. A non-transitory computer readable medium storing computer executable instructions that, when executed by a processor, cause a malware security platform to perform:
determining an environmental indicator used by a target filtering mechanism associated with a malware program to prevent execution in a sandbox environment, wherein the environmental indicator comprises an indication of a file system structure of the sandbox environment;
determining whether the environmental indicator is within a predetermined percentile of environmental indicators, in a malware database, arranged in a priority order from lowest priority to highest priority, wherein the priority order of the environmental indicators is based on respective quantities of malware programs using the environmental indicators; and
based on determining that the environmental indicator is within the predetermined percentile of the environmental indicators:
generating, based on the environmental indicator, an inoculation message for transmission to one or more computing devices in a computing network, wherein the inoculation message comprises the indication of the file system structure; and
sending, to the one or more computing devices, the inoculation message, wherein the inoculation message causes the one or more computing devices to integrate the indication of the file system structure into corresponding computing environments of the one or more computing devices.