Le Journal de la Cybercriminalité et des Investigations Numériques
type: channel
description: Le journal de la Cybercriminalité & des Investigations Numériques (CybIN) est édité par l’association CECyF – Centre expert contre la cybercriminalité français. L’objectif de ce journal est la publication d’articles scientifiques, techniques, juridiques et des diverses sciences qui contribuent à la compréhension et à la lutte contre la cybercriminalité, ainsi qu’à la pratique des enquêtes numériques.
publisher: CECyF
language: fr
publication name: Le Journal de la Cybercriminalité et des Investigations Numériques
issn: 2494-2715
copyright: Authors who publish with this journal agree to the following terms: Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal. Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
items: mirai-toushi: Cross-Architecture Mirai Configuration Extractor Utilizing Standalone Ghidra Script
items: A Taxonomic Overview of Prevalent Malware Communication Strategies
items: GenRex Demonstration: Level Up Your Regex Game
items: IoT Malware and Rookit Detections Using Electromagnetic Insights: Unveiling the Unseen
items: CMK Rootkit. Identifying the ”magic packet” requirements via pattern recognition
items: Boss, our Data is in Russia
items: MCRIT: The MinHash-based Code Relationship & Investigation Toolkit
items: Incremental Clustering of Malware Packers using features based on Transformed CFG
items: From Words to Intelligence
items: Syslogk Rootkit. Executing Bots via "Magic Packets"
items: Yara Studies: A Deep Dive into Scanning Performance
items: Scambaiting as a Preventive Tool in the Fight against Cyberfrauds: the Case of Romance Scams
items: Private Clubs For Hackers
items: Yara: Down the Rabbit Hole Without Slowing Down
items: Detect emerging malware on cloud before VirusTotal can see it
items: Into The Silent Night
items: DeStroid – Fighting String Encryption in Android Malware
items: An Overview of the Botnet Simulation Framework
items: YARA-Signator: Automated Generation of Code-based YARA Rules
items: Collecting Malicious Particles from Neutrino Botnets
items: ApiScout: Robust Windows API Usage Recovery for Malware Characterization and Similarity Analysis
items: An Overview of the WCMS Brute-forcing Malware Landscape
items: Malpedia: A Collaborative Effort to Inventorize the Malware Landscape
items: Exploring a P2P Transient Botnet - From Discovery to Enumeration
items: ISFB: Still Live and Kicking
items: Function Identification and Recovery Signature Tool
items: DGA Clustering and Analysis: Mastering Modern, Evolving Threats, DGALab
items: Behavior-Driven Development in Malware Analysis
items: Building a Hybrid Experimental Platform for Mobile Botnet Research
items: Practical Experiences of Building an IPFIX Based Open Source Botnet Detector

mirai-toushi: Cross-Architecture Mirai Configuration Extractor Utilizing Standalone Ghidra Script
type: item
description: In recent years, IoT malware frequently launches DDoS attacks, causing massive damage to ISPs. Since Mirai and its variants account for the vast majority of IoT malware, security researchers develop configuration extracting tools to understand its characteristics. However, Mirai is built on diverse architectures (e.g., ARM, MIPS, and PowerPC), developing tools is challenging. Indeed, existing tools only support 1 or 2 architectures. In this study, we utilize Ghidra decompiler and intermediate representation P-Code to reduce architecture-dependent codes, and develop Mirai configuration extractor "mirai-toushi" that supported 8 architectures. To evaluate mirai-toushi against real-world malware, we applied mirai-toushi to 2,426 samples collected in honeypot/IPS from March 2020 to March 2024. The existing tool extracted 673 tables containing data such as C2 server destinations and DoS parameters, while mirai-toushi extracted 1,743 tables. In addition, mirai-toushi extracted 1,641 password lists. The results show that mirai-toushi can extract Mirai configurations effectively. To be widely used by security researchers, we have made mirai-toushi publicly available on GitHub.
subject: Conference proceedings
  topic: section
subject: Botnet
  topic: keywords
subject: Malware
  topic: keywords
subject: IoT
  topic: keywords
creator: Shun Morishita
creator: Satoshi Kobayashi
creator: Eisei Hombu
rights: (c) Copyright Shun Morishita (Author) 2025 https://creativecommons.org/licenses/by/4.0
date: 2025-06-05
publication date: 2025-06-05
starting page: 1
ending page: 11
doi: 10.18464/cybin.v10i1.56

A Taxonomic Overview of Prevalent Malware Communication Strategies
type: item
description: Malware analysis remains a critical task in cybersecurity, particularly given the prevalent use of network capabilities by many malware samples. Despite the need to discuss and understand the use of networking in malware, there is currently no comprehensive taxonomy to classify the various aspects of malware C&C communication. This lack of taxonomy has resulted in the absence of a categorized overview of the communication strategies utilized by prevalent malware. Furthermore, no structured data set is available that includes representative samples of common malware families along with their respective network traffic captures, which is crucial to develop new malware networking analysis methods or to improve manual analysis skills. In this paper, we make three main contributions. First, we propose a taxonomy for malware C&C communication strategies, adapted and expanded from the Trend Micro botnet taxonomy, to ensure that it can be systematically applied to categorize and describe C&C communication methods more broadly. Second, we provide an organized summary of the current malware C&C communication landscape, based on the malware families most frequently submitted to MalwareBazaar, to give researchers an overview of common techniques. Third, we release a data set containing samples of these prevalent malware families together with live network traffic captures to facilitate research and the development of new tools for malware networking analysis.
subject: Conference proceedings
  topic: section
subject: Malware analysis
  topic: keywords
subject: C2 communication
  topic: keywords
subject: Network traffic analysis
  topic: keywords
subject: Reverse engineering
  topic: keywords
creator: Steffen Enders
creator: Daniel Plohmann
creator: Manuel Blatt
rights: (c) Copyright Steffen Enders, Daniel Plohmann, Manuel Blatt (Author) 2024 https://creativecommons.org/licenses/by/4.0
date: 2025-02-10
publication date: 2025-02-10
starting page: 1
ending page: 13
doi: 10.18464/cybin.v9i1.53

GenRex Demonstration: Level Up Your Regex Game
type: item
description: GenRex is a unique tool for detecting similarities in artifacts from executable files and the generation of regular expressions. This paper demonstrates how to use GenRex to maximize the usage of regular expressions automatically created from behavioral reports and other potential use cases. GenRex is open-sourced, and additional resources, such as a dataset of behavioral reports and an extension to the YARA tool, are provided.
subject: Conference proceedings
  topic: section
subject: GenRex
  topic: keywords
subject: Malware detection
  topic: keywords
subject: Pattern matching
  topic: keywords
subject: Regular expressions
  topic: keywords
subject: Yara
  topic: keywords
creator: Dominika Regéciová
rights: (c) Copyright Dominika Regéciová (Author) 2024 https://creativecommons.org/licenses/by/4.0
date: 2024-05-01
publication date: 2024-05-01
starting page: 15
ending page: 19
doi: 10.18464/cybin.v9i1.52

IoT Malware and Rookit Detections Using Electromagnetic Insights: Unveiling the Unseen
type: item
description: The Internet of Things (IoT) is a collection of interconnected devices, becoming increasingly complicated and suffering from inadequate security measures. They frequently employ outdated hardware and software without taking security risks into account, which makes them a target for cybercriminals, particularly those specializing in malware and rootkits. In this paper, we will present two strategies for exploiting electromagnetic side channels and address two challenges: malware classification in the presence of obfuscations and rootkit detection. Our approach focuses on IoT devices, specifically targeting ARM and MIPS architectures in Raspberry Pi and Creator CI20 devices. The framework employs advanced data preprocessing methods, allowing analysts to select a variety of machine learning and deep learning models based on their specific requirements. Our finding were published separately at (including data and codes): - ACSAC-2021: "Obfuscation Revealed: Leveraging Electromagnetic Signals for Obfuscated Malware Classification" (with an extended version presented at hardwear.io’22 USA), - RAID-2022: "ULTRA: Ultimate Rootkit Detection over the Air".
subject: Conference proceedings
  topic: section
subject: Malware classification, obfuscation, side-channel analysis, rootkit detection, software-defined radio (SDR), machine learning, deep learning, Electromagnetic, IoT devices
  topic: keywords
creator: Damien Marion
creator: Duy-Phuc Pham
creator: Annelie Heuser
rights: (c) Copyright Damien Marion, Duy-Phuc Pham, Annelie Heuser (Author) 2024 https://creativecommons.org/licenses/by/4.0
date: 2025-05-22
publication date: 2025-05-22
starting page: 20
ending page: 27
doi: 10.18464/cybin.v9i1.51

CMK Rootkit. Identifying the ”magic packet” requirements via pattern recognition
type: item
description: The present paper analyzes the CMK Linux Kernel Rootkit. It demonstrates that it is possible to unpack the rootkit using emulation to avoid inserting the module in a real Linux distribution matching specific Linux kernel requirements. CMK Rootkit implements "magic packets", this study also demonstrates that it is possible to extract the requirements for the "magic packets" based on assembly language patterns. We provide the implementation for both, the Linux kernel rootkit unpacker and a Ghidra script for extracting the requirements of the "magic packets".
subject: Articles additionnels
  topic: section
subject: cmk rootkit
  topic: keywords
subject: syslogk
  topic: keywords
subject: magic packets
  topic: keywords
subject: botnet
  topic: keywords
subject: Netfilter
  topic: keywords
creator: David Álvarez Pérez
creator: Manuel Fernández-Veiga
rights: (c) Copyright David Álvarez Pérez, Manuel Fernández-Veiga (Author) 2024 https://creativecommons.org/licenses/by/4.0
date: 2025-06-05
publication date: 2025-06-05
starting page: A1
ending page: A15
doi: 10.18464/cybin.v9i1.48

Boss, our Data is in Russia
type: item
description: The following position paper discusses the topic of employee criminal liability in the context of ransomware attacks. Through a series of case studies, it analyses whether, under Swiss law, employees who have facilitated the success of an attack can be qualified as co-authors or accomplices. After an overview of the applicable legal framework, this paper analyses three case studies inspired by actual ransomware attacks. It focuses in particular on the element of intent, which is a prerequisite in most cybercrime laws, and which can, under certain conditions, also be applied to behaviours that appear to be the result of "mistakes"; it also discusses the role that in-house cybersecurity training (or the lack thereof) can have in this context. Drawing from the results of the analysed cases, this paper then presents a series of recommendations aimed at reinforcing cybercrime prevention within institutions, while also touching upon topics such as cyber-insurances and certification labels.
subject: Conference proceedings
  topic: section
subject: Ransomware
  topic: keywords
subject: Cyber-attack
  topic: keywords
subject: Criminal libability
  topic: keywords
subject: Employee liability
  topic: keywords
subject: Switzerland
  topic: keywords
subject: Criminal law
  topic: keywords
subject: Cybersecurity
  topic: keywords
creator: Renaud Zbinden
creator: Luca Brunoni
creator: Olivier Beaudet-Labrecque
rights: (c) Copyright Renaud Zbinden, Luca Brunoni, Olivier Beaudet-Labrecque (Author) 2023 https://creativecommons.org/licenses/by/4.0
date: 2023-05-02
publication date: 2023-05-02
starting page: 49
ending page: 56
doi: 10.18464/cybin.v8i1.46

MCRIT: The MinHash-based Code Relationship & Investigation Toolkit
type: item
description: As the number of malware attacks continually rises, malware analysts are facing an ever-increasing workload. The growing complexity of malware families and the sheer volume of new threats make it challenging for analysts to keep up with their analysis tasks. Code similarity analysis offers high potential in this regard, helping analysts to orient themselves and to speed up analysis. While being a very active research field with many recent publications, only few of these focus on malware or support immediate practical usage, as they are rarely accompanied by public code releases. In this paper, we present the MinHash-based Code Relationship & Investigation Toolkit (MCRIT). MCRIT is intended to serve as a framework for code similarity analysis, mainly focusing on One-to-Many (1:N) comparisons and with the ability to recognize and filter out library code. We publish MCRIT as open source, including a dockerized setup for easy deployment.
subject: Conference proceedings
  topic: section
subject: Malware analysis
  topic: keywords
subject: Reverse engineering
  topic: keywords
subject: Code similarity
  topic: keywords
creator: Daniel Plohmann
creator: Manuel Blatt
creator: Daniel Enders
rights: (c) Copyright Daniel Plohmann, Manuel Blatt, Daniel Enders (Author) 2023 https://creativecommons.org/licenses/by/4.0
date: 2023-04-19
publication date: 2023-04-19
starting page: 7
ending page: 18
doi: 10.18464/cybin.v8i1.45

Incremental Clustering of Malware Packers using features based on Transformed CFG
type: item
description: Packer detection is an important topic because most malware is packed and this allows it to avoid detection based on static analysis. Identifying classes of packers is the key to effective detection because it makes it easier to determine from a static analysis whether further analysis is needed or whether a decision is already possible. Thus in this work we propose new features to cluster packers from their unpacking function. This method makes it possible to effectively cluster packers, and is able, by clustering, to identify packer classes used by malware. It is a step towards a larger data clustering allowing to identify custom packers.
subject: Articles additionnels
  topic: section
subject: Botnet
  topic: keywords
subject: Packer
  topic: keywords
subject: Clustering
  topic: keywords
creator: Ludovic Robin
rights: (c) Copyright Ludovic Robin (Author) 2023 https://creativecommons.org/licenses/by/4.0
date: 2023-04-28
publication date: 2023-04-28
starting page: A1
ending page: A8
doi: 10.18464/cybin.v8i1.43

From Words to Intelligence
type: item
description: This paper proposes a system for collecting and structuring blog articles about cyber-attacks, with the goal of improving the ability of security researchers to compare threat actor modus operandi. By grounding our work in the field of criminology, we also formulate a Cyber Operation Constraint Principle that could inform future research. We derived from it a tool, the AbductionReductor, that has the potential to augment partial knowledge about a threat actor's behaviour while investigating its actions. Our approach has the potential to significantly support cyber threat analysis and investigation. Future research must focus on the challenge of synchrony and diachrony linguistic analysis.
subject: Conference proceedings
  topic: section
subject: Criminology
  topic: keywords
subject: Computational cyber threat intelligence
  topic: keywords
subject: Natural language processing
  topic: keywords
subject: Modus operandi
  topic: keywords
creator: Ronan Mouchoux
creator: François Moerman
rights: (c) Copyright Ronan Mouchoux, François Moerman (Author) 2023 https://creativecommons.org/licenses/by/4.0
date: 2023-04-19
publication date: 2023-04-19
starting page: 19
ending page: 40
doi: 10.18464/cybin.v8i1.42

Syslogk Rootkit. Executing Bots via "Magic Packets"
type: item
description: The proliferation of open source Linux kernel rootkits allows malware writers to speed up the process of developing complex malware. This study analyzes the Syslogk Linux kernel rootkit family which reuses code of Adore-Ng. Syslogk allows to remotely execute arbitrary commands and a hidden bot in different modes via "magic packets". Analyzing "magic packets" in reasonable time is a challenging task. Furthermore, the hidden bot, implements a proxy mode that allows to hide the IP address of the attacker while executing commands in other infected machines. This new botnet structure can also inspire future Linux threats, including IoT threats.
subject: Conference proceedings
  topic: section
subject: Syslogk
  topic: keywords
subject: Rootkit
  topic: keywords
subject: Botnet
  topic: keywords
subject: Netfilter
  topic: keywords
creator: David Álvarez Pérez
rights: (c) Copyright David Álvarez Pérez (Author) 2023 https://creativecommons.org/licenses/by/4.0
date: 2023-05-02
publication date: 2023-05-02
starting page: 41
ending page: 48
doi: 10.18464/cybin.v8i1.41

Yara Studies: A Deep Dive into Scanning Performance
type: item
description: You probably know this scenario - you spent a while analyzing new samples, which was not easy, but you’re finally done. You also created a neat Yara rule to match the samples, and you're ready to send it off and move on to your next task (or lunch). But oopsie - the Yara rule is warning of slowed scanning. Or your colleague comments they do not like a particular part and wants to be sure the rule is effective. While working with Yara, I consulted with many analysts about this problem. They knew what they wanted to detect, but Yara was not always helping them write the rules more effectively. Based on my experience with algorithms used in Yara, we worked together to find a solution to improve scanning speed and limit potential hurdles for future usage. This paper presents five studies with descriptions of the five problems, an explanation of why Yara does not like the first solution, and tips on what can be improved. Note that no sensitive information is disclosed in this paper. All studies were anonymized, so the general problem is the same, but there is no direct link to a specific malware family mentioned, nor can it be tracked.
subject: Conference proceedings
  topic: section
subject: Pattern matching
  topic: keywords
subject: Performance
  topic: keywords
subject: Regular expressions
  topic: keywords
subject: Yara
  topic: keywords
subject: Malware detection
  topic: keywords
creator: Dominika Regéciová
rights: (c) Copyright Dominika Regéciová (Author) 2023 https://creativecommons.org/licenses/by/4.0
date: 2023-04-14
publication date: 2023-04-14
starting page: 1
ending page: 6
doi: 10.18464/cybin.v8i1.40

Scambaiting as a Preventive Tool in the Fight against Cyberfrauds: the Case of Romance Scams
type: item
description: The following paper discusses the potential of using scambaiting techniques to mitigate online fraud. It draws from the experience and the results of a recent project led by the authors, in which researchers posed as targets on dating platforms and interacted with criminals engaging in romance scams – a prominent type of fraud that generates massive economic and emotional damages. The aim of the project was to model their modus operandi, use the gathered data to explore possible ways to disrupt and frustrate further criminal conduct, and evaluate the potential of such techniques. After providing the scientific context of the project, this paper will detail the methodology and the strategies used by the research team for their scambaiting experiment. A brief survey of the most interesting results will then be presented. The last part of this paper will focus on the challenges and opportunities of using scambaiting as a law enforcement tool to fight online fraud.
subject: Articles additionnels
  topic: section
subject: Covid-19
  topic: keywords
subject: Cybercrime
  topic: keywords
subject: Romance scams
  topic: keywords
creator: Renaud Zbinden
creator: Olivier Beaudet-Labrecque
creator: Flore Grandjean
creator: Cloé Gobeil
creator: Luca Brunoni
creator: David Décary-Hétu
creator: Cristina Cretu-Adatte
rights: (c) Copyright Renaud Zbinden, Olivier Beaudet-Labrecque, Flore Grandjean, Cloé Gobeil, Luca Brunoni, David Décary-Hétu, Cristina Cretu-Adatte (Author) 2023 https://creativecommons.org/licenses/by/4.0
date: 2023-05-02
publication date: 2023-05-02
starting page: A9
ending page: A18
doi: 10.18464/cybin.v8i1.37

Private Clubs For Hackers
type: item
description: Offenders seek online private discussion forums where participants are screened before gaining access to connect with sophisticated peers and evade detection. Past research finds that most public discussion forum participants have a low level of technical skill and rely on more established participants for the tools and techniques they need to commit their offences. To date, research has mostly focused on public discussion forums of online offenders as gaining access to private forums comes with many challenges. The aim of this research is to describe and understand the impacts of the private nature of discussion forums on their participants’ activities. Our driving hypothesis is that private discussion forums are host to more sophisticated participants that will, in turn, offer and have access to more sophisticated tools. To understand the impacts of the private nature of discussion forums, we selected two discussion forums available on the internet whose focus is the sale of malware; one of them is private, while the other is public. Our analysis suggests that while there are differences between private and public discussion forums, there are few significant differences between both inters of the products they advertise.
subject: Conference proceedings
  topic: section
subject: Malware
  topic: keywords
subject: Discussion forum
  topic: keywords
subject: Hacking
  topic: keywords
creator: Renaud Zbinden
creator: Sandra Langel
creator: Olivier Beaudet-Labrecque
creator: David Décary-Hétu
creator: Luca Brunoni
rights: (c) Copyright Renaud Zbinden, Sandra Langel, Olivier Beaudet-Labrecque, David Décary-Hétu, Luca Brunoni (Author) 2024 https://creativecommons.org/licenses/by/4.0
date: 2022-10-04
publication date: 2022-10-04
starting page: 22
ending page: 34
doi: 10.18464/cybin.v7i1.36

Yara: Down the Rabbit Hole Without Slowing Down
type: item
description: Terry and John are two malware analysts working for an unnamed antivirus company. Terry has worked there for many years, and he is helping John, who started recently, to learn more about their work. John is starting to use Yara -- an excellent tool for the description and detection of malware families. With Terry, they are analyzing potentially malicious samples, and they are creating so-called Yara rules. This is not a simple task to do -- Yara may be easy to use, but it is difficult to master. How to write the best rule possible? The rule that is good in detection, precise, but also fast? Luckily, they have help - a researcher Caitlin, who is not scared to get really deep into Yara. Today, all three of them will go deeper into Yara than ever before -- the journey to the rabbit hole can begin.
subject: Conference proceedings
  topic: section
subject: Pattern matching
  topic: keywords
subject: Performance
  topic: keywords
subject: Regular expressions
  topic: keywords
subject: Yara
  topic: keywords
creator: Dominika Regéciová
rights: (c) Copyright Dominika Regéciová (Author) 2024 https://creativecommons.org/licenses/by/4.0
date: 2022-08-25
publication date: 2022-08-25
starting page: 17
ending page: 21
doi: 10.18464/cybin.v7i1.35

Detect emerging malware on cloud before VirusTotal can see it
type: item
description: In this paper, we present a new methodology to discover emerging malware where new malware candidates are continuously discovered by our general anomaly detection, and the graph learning system predicts the behavior and the threat family using fuzzy similarity via a correlation knowledge graph to support further analysis by the security researchers, or for the automatic enforcement and remediation. This methodology can be applied at large scale to detect and analyze emerging malware while providing rich contextual information.
subject: Conference proceedings
  topic: section
subject: Fuzzy hash
  topic: keywords
subject: ssdeep
  topic: keywords
subject: Similarity graph
  topic: keywords
subject: Algorithms
  topic: keywords
creator: Thanh Nguyen
creator: Gan Feng
creator: Andreas Pfadler
creator: Anastasia Poliakova
creator: Ali Fakeri-Tabrizi
creator: Hongliang Liu
creator: Yuriy Yuzifovich
rights: (c) Copyright Thanh Nguyen, Gan Feng, Andreas Pfadler, Anastasia Poliakova, Ali Fakeri-Tabrizi, Hongliang Liu, Yuriy Yuzifovich (Author) 2024 https://creativecommons.org/licenses/by/4.0
date: 2022-08-19
publication date: 2022-08-19
starting page: 7
ending page: 16
doi: 10.18464/cybin.v7i1.33

Into The Silent Night
type: item
description: Since the birth of Zeus family malwares, they have been sharpening their edge. Zloader is one of the active variants among Zeus family malwares. In December 2019, Zloader revived as “Silent Night.” It communicates with C&C servers using DGA (Domain Generation Algorithm), because changing C&C servers’ domain names can bypass malware detection systems. As a result, it makes it easier to steal information from infected hosts. This study proposes a system that traces Zloader’s C&C servers automatically. This system collects samples, analyzes configuration data, and calculates DGA domains. Moreover, the system collects log files that store information about the infected hosts on the attackers’ servers. The system can not only generate threat intelligence about Zloader for SOC and CSIRT but also follow the trend of attack campaigns. Furthermore, we will discuss how attackers acquire the DGA domains tactically.
subject: Conference proceedings
  topic: section
subject: Banking trojan
  topic: keywords
subject: Zloader
  topic: keywords
subject: Botnet tracking
  topic: keywords
subject: System development
  topic: keywords
creator: Yuta Sawabe
creator: Ryuichi Tanabe
creator: Fumio Ozawa
creator: Rintaro Koike
rights: (c) Copyright Yuta Sawabe, Ryuichi Tanabe, Fumio Ozawa, Rintaro Koike (Author) 2024 https://creativecommons.org/licenses/by/4.0
date: 2022-08-01
publication date: 2022-08-01
starting page: 1
ending page: 6
doi: 10.18464/cybin.v7i1.32

DeStroid – Fighting String Encryption in Android Malware
type: item
description: String encryption is a popular technique to obfuscate the functionality, inner workings, and goals of Android apps. Especially malicious apps use this technique to thwart automatic and manual analyses. Typically, a human analyst has to manually identify the decryption routines and afterwards use these routines to decrypt the strings contained in an app. This is a time-consuming and tedious task. What is more, it has to be carried out potentially for every new malware version as the authors frequently modify their techniques. We analyzed the Android malware corpus of Malpedia [1] and found that string encryption is used in more than half of the samples. This demonstrates that string encryption is still a prevailing obfuscation method nowadays. In this paper we present DeStroid, an approach to fully automatically decrypt obfuscated strings from Android apps. We focus in particular on current Android malware using advanced string encryption techniques and show that DeStroid outperforms all publicly available string deobfuscation approaches.
subject: Conference proceedings
  topic: section
creator: Daniel Baier
creator: Martin Lambertz
rights: (c) Copyright Daniel Baier, Martin Lambertz (Author) 2019 https://creativecommons.org/licenses/by/4.0
date: 2019-12-31
publication date: 2019-12-31
starting page: 14
ending page: 30
doi: 10.18464/cybin.v5i1.31

An Overview of the Botnet Simulation Framework
type: item
description: Conducting research on botnets is oftentimes limited to the analysis of active botnets. This prevents researchers from testing detection and tracking mechanisms on potential future threats. Specifically, in the domain of P2P botnets, the protocol specifics, network churn and anti-tracking mechanisms greatly impact the success or failure of monitoring operations. Moreover, experiments on real world botnets, commonly lack ground truth to verify the findings. As developing and deploying botnets of sufficient size is accompanied by large costs and administration efforts, this paper attempts to address this issue by introducing a simulation framework for P2P botnets called Botnet Simulation Framework (BSF). BSF can simulate monitoring operations in botnets of more than 20.000 bots to evaluate tracking mechanisms or simulate takedown efforts. Moreover, communication traces can be exported to inject traffic into arbitrary PCAP files for training and evaluation of intrusion detection systems.
subject: Conference proceedings
  topic: section
subject: Botnets
  topic: keywords
subject: P2P Botnet
  topic: keywords
subject: Simulation
  topic: keywords
subject: Dataset generation
  topic: keywords
creator: Leon Böck
creator: Shankar Karuppayah
creator: Max Mühlhäuser
creator: Emmanouil Vasilomanolakis
rights: (c) Copyright Leon Böck, Shankar Karuppayah, Max Mühlhäuser, Emmanouil Vasilomanolakis (Author) 2020 https://creativecommons.org/licenses/by/4.0
date: 2020-12-06
publication date: 2020-12-06
starting page: 1
ending page: 10
doi: 10.18464/cybin.v6i1.25

YARA-Signator: Automated Generation of Code-based YARA Rules
type: item
description: Effective detection and identification signatures are an important component in the toolkit for malware analysis. The creation of such signatures is still widely a manual task that requires notable experience and knowledge on the side of analysts. In this paper, we present YARA-Signator, an approach for the automated generation of code-based YARA rules. The method is based on the isolation of instruction n-grams that on the one hand appear frequently within a malware family and on the other hand are not found in any other family. Applying YARA-Signator to the Malpedia data set, we show that in fact on average 51.85% of the instruction n-grams of length 4 and higher are only found in the respective family. The rules produced by the system using this data set achieve an overall F1 score of 0.983 and cause only very few false positives in a sanity check against a large goodware data set. YARASignator is made available as open source and a periodically updated reference rule set is provided for free through Malpedia.
subject: Conference proceedings
  topic: section
creator: Felix Bilstein
creator: Daniel Plohmann
rights: (c) Copyright Felix Bilstein, Daniel Plohmann (Author) 2019 https://creativecommons.org/licenses/by/4.0
date: 2019-12-31
publication date: 2019-12-31
starting page: 1
ending page: 13
doi: 10.18464/cybin.v5i1.24

Collecting Malicious Particles from Neutrino Botnets
type: item
description: Neutrino Bot (also known and detected as Win/Kasidet) is a rapidly changing threat. It first became known around December 2013. It has been actively developed ever since resulting in version 5.4 at the very beginning of 2018. It is being sold for an attractive price to a large variety of cybercriminals. This paper shows an extensive summary of the history of the bot while focusing on the most recent versions. It presents methods how to analyse Neutrino botnets and provides key findings that have been discovered during the year 2018.
subject: Conference proceedings
  topic: section
subject: Neutrino Bot
  topic: keywords
subject: Kasidet
  topic: keywords
subject: Bot
  topic: keywords
subject: Botnet
  topic: keywords
subject: Reverse engineering
  topic: keywords
creator: Jakub Souček
creator: Jakub Tomanek
creator: Peter Kálnai
rights: (c) Copyright Jakub Souček, Jakub Tomanek, Peter Kálnai (Author) 2018 https://creativecommons.org/licenses/by/4.0
date: 2018-12-10
publication date: 2018-12-10
starting page: 17
ending page: 32
doi: 10.18464/cybin.v4i1.22

ApiScout: Robust Windows API Usage Recovery for Malware Characterization and Similarity Analysis
type: item
description: Given today's masses of malware there is a need for fast analysis and comparison of samples. System API usage has been proven to be a very valuable source of information for this e.g. shown by Rieck et al. However, the majority of malware samples is shipped packed, making it hard to get accurate information on their payload's API usage. Today's state of the art to get this information from packed samples is by unpacking them or dumping memory with subsequent reconstruction of imports using tools like ImpREC and Scylla. This has several drawbacks since it is a manual procedure requiring a live process environment and suffers from inaccuracy due to missed dynamic imports. In this paper, we present ApiScout, a fully automated method to recover API usage information from memory dumps. It does not require a live process environment and is capable of handling dynamic imports leading to more accurate results compared to existing approaches. ApiScout is a two-staged approach. The first stage is a preparation step creating a database of candidate offsets for API functions. In the second step we crawl through a given memory dump of a process and match all possible DWORDs and QWORDs against this database yielding us API reference candidates. We filter and enrich candidates using different procedures leading us to the desired API usage information. Based on this information, our second contribution in this paper is a concept called ApiVectors. It efficiently stores the information extracted by ApiScout. This enables fast assessment of a malware's potential capabilities and allows similarity analysis of API usage across samples. For the latter the methods imphash and impfuzzy are the de facto standard. However, they both suffer from inaccuracy due to exclusively relying on the import table and non-recoverability of input data. In our approach we use Jaccard and Tanimoto similarity to compare ApiVectors, leading to a much higher accuracy. Our third contribution is an extensive an…
subject: Conference proceedings
  topic: section
subject: Malware analysis
  topic: keywords
subject: Malware classification
  topic: keywords
subject: Windows API
  topic: keywords
subject: Visualization
  topic: keywords
creator: Daniel Plohmann
creator: Steffen Enders
creator: Elmar Padilla
rights: (c) Copyright Daniel Plohmann, Steffen Enders, Elmar Padilla (Author) 2018 https://creativecommons.org/licenses/by/4.0
date: 2018-12-09
publication date: 2018-12-09
starting page: 1
ending page: 16
doi: 10.18464/cybin.v4i1.20

An Overview of the WCMS Brute-forcing Malware Landscape
type: item
description: Web Content Management Systems (WCMS) provide simple tools to manage web content that enables users with little knowledge of programming languages and web design. WCMSs have become extremely popular in the last decade. WordPress, with more than 18M websites world wide, is the most prominent WCMS. Is because of its popularity that this and other well-known WCMSs have been systematically attacked for the past years by different threat actors seeking disposable infrastructure for their attacks. Brute-force attacks are one of the most common types of attacks against WCMSs. The goal of such an attack is to guess a valid user name and password in order to access the WCMS administration panel. Attackers especially take advantage of users choosing weak credentials. Successfully brute-forced websites are typically used for hosting C\&Cs, scams, and drive-by attacks to spread malware. This paper presents an historical overview and current state of WCMS brute-force attacks with a focus on botnets and techniques used. We present a case of study of Sathurbot, a modular HTTP-based botnet. Finally, we discuss detection methods to identify these type of attacks.
subject: Conference proceedings
  topic: section
subject: Botnet
  topic: keywords
subject: Brute-force
  topic: keywords
subject: Network
  topic: keywords
subject: IDS
  topic: keywords
creator: Anna Shirokova
creator: Veronica Valeros
rights: (c) Copyright Anna Shirokova, Veronica Valeros (Author) 2024 https://creativecommons.org/licenses/by/4.0
date: 2017-12-31
publication date: 2017-12-31
starting page: 20
ending page: 29
doi: 10.18464/cybin.v3i1.18

Malpedia: A Collaborative Effort to Inventorize the Malware Landscape
type: item
description: For more than a decade now, a perpetual influx of new malware samples can be observed. To analyze this flood effectively, static analysis is still one of the most important methods. Thus, it would be highly desirable to have an open, freely accessible, curated, and cleanly labeled corpus of unpacked malware samples for research on static analysis methods. In this paper, we introduce MALPEDIA, a collaboration platform for curating a malware corpus. Additionally, we provide a baseline for a cleanly labeled malware corpus consisting of 607 families divided into 1792 samples. This corpus offers a plethora of possibilities for researchers, including using it as a testbed for evaluations on detection and analysis methods, quality assurance for classification, and contextualization of new malware. To ensure the quality of our corpus, we adapted the requirements by Rossow et al., derive specific requirements for the context of static malware analysis, and evaluate our corpus against them. Based on our corpus, we show that looking beyond packers dramatically reduces the size needed for a corpus to be representative, as the number of distinct malware families and versions after unpacking is orders of magnitude smaller than the number of unique packed samples. Additionally, we perform a comprehensive study of the Windows malware in the corpus, scrutinizing its structural features. This analysis clearly illustrates that MALPEDIA offers a wealth of information, readily available for in-depth investigations.
subject: Conference proceedings
  topic: section
subject: Malware corpus
  topic: keywords
subject: Malware analysis
  topic: keywords
creator: Daniel Plohmann
creator: Martin Clauß
creator: Steffen Enders
creator: Elmar Padilla
rights: (c) Copyright Daniel Plohmann, Martin Clauß, Steffen Enders, Elmar Padilla (Author) 2024 https://creativecommons.org/licenses/by/4.0
date: 2017-12-31
publication date: 2017-12-31
starting page: 1
ending page: 19
doi: 10.18464/cybin.v3i1.17

Exploring a P2P Transient Botnet - From Discovery to Enumeration
type: item
description: From DDoS attacks to malicious code propagation, Botnets continue to represent a strength threat to entities and users connected to the Internet and, due to this, continue to be an important research area. The power of those numerous networks proved us its power when they interrupted great part of the Internet causing impacts to companies like Twitter and Netflix when Mirai P2P Botnet targeted Dyn company’s DNS services back in 2016. In this paper, we present the study that allowed us to find out a “Mirai-like botnet called Rakos - from our high interactivity honeypot recruitment to the detailed analysis and exploitation of this botnet C&C protocol using crawling and node-injection methods to enumerate and estimate its size. Our contribution includes also a comparison between two P2P botnet exploration methods used in our research and in which situations they may be better suitable in further analysis. Additionally, we propose the term “transient to designate botnets formed by malware that does not use persistence on the compromised system as this tends to be usual amongst modern threats to IoT (Internet of Things) devices.
subject: Conference proceedings
  topic: section
subject: Botnet
  topic: keywords
subject: Transient
  topic: keywords
subject: IoT
  topic: keywords
subject: DDoS
  topic: keywords
creator: Renato Marinho
creator: Raimir Holanda
rights: (c) Copyright Renato Marinho, Raimir Holanda (Author) 2024 https://creativecommons.org/licenses/by/4.0
date: 2017-12-31
publication date: 2017-12-31
starting page: 30
ending page: 39
doi: 10.18464/cybin.v3i1.16

ISFB: Still Live and Kicking
type: item
description: ISFB is also known as Gozi2/Ursnif, sometimes Rovnix. ISFB reappeared in early 2013 attracting some attention from the research community and a lot of confusion in the naming convention and to what was being analyzed. Then suddenly, it went dark again. However, dark does not mean dead. With attention of the world focused on Dridex and Dyre, ISFB silently evolved, hiding from the spotlight to become one of the most complex and fully featured banking trojans out there In this paper, we break the silence surrounding ISFB, giving a full description of this malware capabilities which are beyond those of the average banking trojan: 4 ways of communicating with the CC, half a dozen tricks to steal your money, the ability to create movies of your activity and naturally numerous ways of manipulating your web traffic.
subject: Conference proceedings
  topic: section
subject: Botnet
  topic: keywords
subject: Malware
  topic: keywords
subject: C&C
  topic: keywords
subject: Reverse engineering
  topic: keywords
creator: Maciej Kotowicz
rights: (c) Copyright Maciej Kotowicz (Author) 2017 https://creativecommons.org/licenses/by/4.0
date: 2017-07-02
publication date: 2017-07-02
starting page: 1
ending page: 14
doi: 10.18464/cybin.v2i1.15

Function Identification and Recovery Signature Tool
type: item
description: Reverse Engineering benign or malicious samples can take a considerable amount of time and new samples are created at an alarming rate. Leveraging disassemblers, like IDA Pro, a reverse engineer can analyze the same routines across several samples over the lifetime of their career. Their knowledge is not easily transferred to similar samples or functions for themselves or others. In particular we can consider the problem code reuse has on reversing efforts, whether it is via statically-linked libraries or integrating existing software. In this paper we want to provide a solution for transferring knowledge to similar functions by introducing a new reverse engineering tool, named FIRST (Function Identification and Recovery Signature Tool), to reduce analysis time and enable information sharing.
subject: Papiers courts de conférence
  topic: section
subject: FIRST
  topic: keywords
subject: Reverse engineering
  topic: keywords
subject: Disassembly analysis
  topic: keywords
subject: Code reuse
  topic: keywords
creator: Angel M. Villegas
rights: (c) Copyright Angel M. Villegas (Author) 2017 https://creativecommons.org/licenses/by/4.0
date: 2017-04-02
publication date: 2017-04-02
starting page: 15
ending page: 19
doi: 10.18464/cybin.v2i1.14

DGA Clustering and Analysis: Mastering Modern, Evolving Threats, DGALab
type: item
description: Domain Generation Algorithms (DGA) is a basic building block used in almost all modern malware. Malware researchers have attempted to tackle the DGA problem with various tools and techniques, with varying degrees of success. We present a complex solution to populate DGA feed using reversed DGAs, third-party feeds, and a smart DGA extraction and clustering based on emulation of a large number of samples. Smart DGA extraction requires no reverse engineering and works regardless of the DGA type or initialization vector, while enabling a cluster-based analysis. Our method also automatically allows analysis of the whole malware family, specific campaign, etc. We present our system and demonstrate its abilities on more than 20 malware families. This includes showing connections between different campaigns, as well as comparing results. Most importantly, we discuss how to utilize the outcome of the analysis to create smarter protections against similar malware.
subject: Papiers courts de conférence
  topic: section
subject: Malware
  topic: keywords
subject: DGA
  topic: keywords
subject: Clustering
  topic: keywords
subject: Automation
  topic: keywords
subject: Reverse engineering
  topic: keywords
subject: Threat intelligence
  topic: keywords
creator: Alexander Chailytko
creator: Aliaksandr Trafimchuk
rights: (c) Copyright Alexander Chailytko, Aliaksandr Trafimchuk (Author) 2015 https://creativecommons.org/licenses/by/4.0
date: 2016-05-12
publication date: 2016-05-12
starting page: 67
ending page: 69
doi: 10.18464/cybin.v1i1.10

Behavior-Driven Development in Malware Analysis
type: item
description: A daily task of malware analysts is the extraction of behaviors from malicious binaries. Such behaviors include domain generation algorithms, cryptographic algorithms or deinstallation routines. Ideally, this tedious task should be automated. So far scientific solutions have not gotten beyond proof-of-concepts. Malware analysts continue to reimplement behaviors of interest manually. However, often times they merely translate the malicious binary assembler code to a higher-level language. This yields to poorly readable and undocumented code whose correctness is not ensured. Furthermore, the current process that malware analysts are following leads to a suboptimal focusing since they deal with too much binary code at once. In this paper, we aim at overcoming these shortcomings by improving the malware analysis process regarding the reimplementation of malicious behaviors. We achieve this by integrating Behavior-Driven Development in the malware analysis process. We explain in detail how the integration of Behavior-Driven Development into the malware analysis process can be done. In a case study on the highly obfuscated malware Nymaim, we show the feasibility of our approach.
subject: Conference proceedings
  topic: section
creator: Thomas Barabosch
creator: Elmar Gerhards-Padilla
rights: (c) Copyright Thomas Barabosch, Elmar Gerhards-Padilla (Author) 2015 https://creativecommons.org/licenses/by/4.0
date: 2016-03-18
publication date: 2016-03-18
starting page: 41
ending page: 48
doi: 10.18464/cybin.v1i1.9

Building a Hybrid Experimental Platform for Mobile Botnet Research
type: item
description: Mobile botnets are an emerging security threat that aims at exploiting the wide penetration of mobile devices and systems and their vulnerabilities in the same spirit of traditional botnets. Mobile botmasters take advantage of infected mobile devices and issue command and control operations on them to extract personal information, cause denial of service or gain financially. To date, research on countering such attacks or studying their effects has been conducted in a sporadic manner that hinders the repetition of experiments and thus limits their validity. We present here our work on a hybrid experimental platform for mobile botnets that supports the execution and monitoring of related scenarios concerning their infection, attack vectors, propagation, etc. The platform is based on principles of flexibility, extensibility and facilitates the setup of scalable experiments utilising both real and emulated mobile systems. We also discuss a novel method of estimating the active bot population in a botnet and illustrate its deployment on the experimental platform.
subject: Conference proceedings
  topic: section
creator: Apostolos Malatras
creator: Laurent Beslay
rights: (c) Copyright Apostolos Malatras, Laurent Beslay (Author) 2015 https://creativecommons.org/licenses/by/4.0
date: 2016-03-10
publication date: 2016-03-10
starting page: 29
ending page: 39
doi: 10.18464/cybin.v1i1.8

Practical Experiences of Building an IPFIX Based Open Source Botnet Detector
type: item
description: The academic study of flow-based malware detection has primarily focused on NetFlow v5 and v9. In 2013 IPFIX was ratified as the flow export standard. As part of a larger project to develop protection methods for Cloud Service Providers from botnet threats, this paper considers the challenges involved in designing an open source IPFIX based botnet detection function. This paper describes how these challenges were overcome and presents an open source system built upon Xen hypervisor and Open vSwitch that is able to display botnet traffic within Cloud Service Provider-style virtualised environments. The system utilises Euler property graphs to display suspect “botnestsâ€. The conceptual framework presented provides a vendor-neutral, real-time detection mechanism for monitoring botnet communication traffic within cloud architectures and the Internet of Things.
subject: Conference proceedings
  topic: section
creator: Mark Graham
creator: Adrian Winckles
creator: Erika Sanchez-Velazquez
rights: (c) Copyright Mark Graham, Adrian Winckles, Erika Sanchez-Velazquez (Author) 2015 https://creativecommons.org/licenses/by/4.0
date: 2016-03-07
publication date: 2016-03-07
starting page: 21
ending page: 28
doi: 10.18464/cybin.v1i1.7