Visible to the public SysTaint: Assisting Reversing of Malicious Network Communications

TitleSysTaint: Assisting Reversing of Malicious Network Communications
Publication TypeConference Paper
Year of Publication2018
AuthorsViglianisi, Gabriele, Carminati, Michele, Polino, Mario, Continella, Andrea, Zanero, Stefano
Conference NameProceedings of the 8th Software Security, Protection, and Reverse Engineering Workshop
Conference LocationNew York, NY, USA
ISBN Number978-1-4503-6096-8
KeywordsBotnet, communication protocol, Human Behavior, malware analysis, Metrics, pubcrawl, Resiliency, software reverse engineering, virtualization

The ever-increasing number of malware samples demands for automated tools that aid the analysts in the reverse engineering of complex malicious binaries. Frequently, malware communicates over an encrypted channel with external network resources under the control of malicious actors, such as Command and Control servers that control the botnet of infected machines. Hence, a key aspect in malware analysis is uncovering and understanding the semantics of network communications. In this paper we present SysTaint, a semi-automated tool that runs malware samples in a controlled environment and analyzes their execution to support the analyst in identifying the functions involved in the communication and the exchanged data. Our evaluation on four banking Trojan samples from different families shows that SysTaint is able to handle and inspect encrypted network communications, obtaining useful information on the data being sent and received, on how each sample processes this data, and on the inner portions of code that deal with the data processing.

Citation Keyviglianisi_systaint:_2018