Cobra: fine-grained malware analysis using stealth localized-executions

Abstract

Fine-grained code analysis in the context of malware is a complex and challenging task that provides insight into malware code-layers (polymorphic/metamorphic), its data encryption/decryption engine, its memory layout etc., important pieces of information that can be used to detect and counter the malware and its variants. Current research in fine-grained code analysis can be categorized into static and dynamic approaches. Static approaches have been tailored towards malware and allow exhaustive fine-grained malicious code analysis, but lack support for self-modifying code, have limitations related to code-obfuscations and face the undecidability problem. Given that most if not all malware employ self-modifying code and code-obfuscations, poses the need to analyze them at runtime using dynamic approaches. However, current dynamic approaches for fine-grained code analysis are not tailored specifically towards malware and lack support for multithreading, self-modifying/self-checking code and are easily detected and countered by ever-evolving anti-analysis tricks employed by malware.To address this problem we propose a powerful dynamic fine-grained malicious code analysis framework, codenamed Cobra, to combat malware that are becoming increasingly hard to analyze. Our goal is to provide a stealth, efficient, portable and easy-to-use framework supporting multithreading, self-modifying/self-checking code and any form of code obfuscation in both user-and kernel-mode on commodity operating systems. Cobra cannot be detected or countered and can be dynamically and selectively deployed on malware specific code-streams while allowing other code-streams to execute as is. We also illustrate the framework utility by describing our experience with a tool employing Cobra to analyze a real-world malware.

Evasive Malware via Identifier Implanting

“…Vasudevan and Yerraballi proposed Cobra [58], which is a first dynamic analysis system focused on countering antianalysis techniques. Dinaburg et al proposed Ether [24], a transparent sandbox using hardware virtualization extensions such as Intel VT. Those systems focus on how to conceal the existence of analysis mechanisms from malware.…”

CloudIDEA: A Malware Defense Architecture for Cloud Data Centers

“…Cobra, a framework by Vasudevan and Yerraballi [43], is known to be one of the first malware dynamic analysis frameworks with an explicit emphasis on stealth as a design goal, also providing support for self-modifying, self-checking code, and any form of code obfuscation. A somewhat stronger solution was proposed by Dinaburg et al [8].…”

Proactive Detection of Computer Worms Using Model Checking

“…A sandbox consists of a virtual machine and a simulated environment which are used to run suspicious executables for a limited time span. Depending on the sequence of actions, the simulated program is classified as malicious or benign [8], [9], [10], [11]. Sandbox-based systems suffer from the same restrictions as HIDS, but additionally monitor a program only over a short timeframe, making them blind towards malware that does not execute its payload right away.…”