Description

Abstract

Malwares are becoming increasingly stealthy, more and more malwares are using cryptographic algorithms (e.g., packing, encrypting C&C communication) to protect themselves from being analyzed. The use of cryptographic algorithms and truly transient cryptographic secrets inside the malware binary imposes a key obstacle to effective malware analysis and defense. To enable more effective malware analysis, forensics and reverse engineering, we have developed a novel approach which combines CipherXRay – a novel binary analysis framework that can automatically identify and recover the cryptographic operations and defining the path randomly between the transmitter and receiver using swarm optimization . CipherXRay can further identify certain operation modes (e.g., ECB, CBC, CFB) of the identified block cipher and tell whether the identified block cipher operation is encryption or decryption in certain cases.