Systematic Approach to Malware Analysis (SAMA)

Abstract

Featured Application: The systematic and methodological process of analysis described in this document will provide a complete understanding of the life cycle of a malware specimen in terms of its behavior, operation, interaction with the environment, methods of concealment and obfuscation, system updates, and communications.Abstract: Malware threats pose new challenges to analytic and reverse engineering tasks. It is needed for a systematic approach to that analysis, in an attempt to fully uncover their underlying attack vectors and techniques and find commonalities between them. In this paper, a method of malware analysis is described, together with a report of its application to the case of Flame and Red October. The method has also been used by different analysts to analyze other malware threats like 'Stuxnet', 'Dark Comet', 'Poison Ivy', 'Locky', 'Careto', and 'Sofacy Carberp'. The method presented in this work is a systematic and methodological process of analysis, whose main objective is the acquisition of knowledge as well as to gain a full understanding of a particular malware. Using the proposed method to analyze two well-known malware as 'Flame' and 'Red October' will help to understand the added value of the method.

Benchmarking Android malware analysis tools

“…Notwithstanding, obfuscation techniques represent a major impediment to the success of this approach [15]. The "static analysis" incorporates the utilization of reverse engineering methods to analyze the instruction set that characterizes the functioning of the application [16]. In addition, and with a focus on the Android platform, a wide range of features can be discovered through this type of analysis.…”

Comparative Review of Malware Analysis Methodologies

“…Almost 10 years after MARE was published, a second structured methodology for MA was developed. The newly created methodology was named SAMA [6]. Given the fact that attack vectors have increased immensely during those years it seems that the MARE methodology could be deemed as inadequate for the present needs.…”

“…Behavioral Analysis Figure 1. MARE and SAMA phases comparison [6] The aim of the new procedure is the provision of a framework capable of analyzing modern and complex malware. The demand for such a framework is the need for an iterative process which is systematic, structured, founded upon solid and rigid methods, able to assist the analysts in acquiring the knowledge necessary from a specific malware.…”

“…While trustworthy there was a need of something contemporary to tackle the challenges presented in the modern battlefield. In 2020, the SAMA methodology (Systematic Approach to Malware Analysis) [6] was presented. SAMA was created by the aforementioned need for a new procedural model designed to face the newly emerged threats.…”

Kapımdaki Düşman: Arka Kapı Trojen Saldırıları için Adli Bilişim Analizi Yaklaşımı

“…In studies, showed that static analysis alone is not enough to detect or classify malware. He/She also has claimed to be a necessary complement to static analysis in dynamic analysis of malware in a virtual machine environment, as it is less vulnerable to code cloaking transformation [8].…”