Better Understanding Malware through a Deep Analysis of the Infection Chain

Nowadays, the Internet is part of a large majority of people's daily life, and more and more businesses use it in their daily activities.Moreover, many important institutions, such as hospitals, are modernizing themselves and implementing systems that connect to the Internet.Thus, malicious software, i.e., malware, now has a large pool of potential victims, and has the potential to do considerable damage in many businesses.Although antivirus companies develop malware signatures and detection heuristics to address this issue, cybercriminals constantly update their malware in order to evade security software.Thus, to this day, malware still presents a large threat.In this thesis, we analyze the entire malware exploitation infection chain through its different steps in order to better understand the ecosystem of malicious actors and their operations.First, we focus on the attraction of victims by establishing communities of interests in social networks and classifying malicious messages according to their topics and diffusion paths through these communities.Previous research focused on building detection models using features derived from message content or account caracteristics, which can be circumvented by attackers by modifying their malicious messages accordingly.We present a novel approach which detects spam messages on social networks by modeling the way in which a message travels through communities.We argue that the way a legitimate message spreads through online social networks is harder to simulate for attackers.Second, we extract the web redirections occurring once a user accesses a malicious link, and we then classify the malicious web page sending the malicious payload to the user, namely the exploit kit, according to these redirection chains.Previous research built detection models for malware binaries and exploit kits using their content features and their behavior.We present a novel approach at identifying an exploit kit family by using solely features extracted from the redirection chain leading to it.With this approach, we provide insights into which exploit kit families follow an identifiable pattern in its prior web redirections, and which ones appear to employ the Exploit-as-a-Service business model.Third, following the redirections to the malicious webpage, a downloader software is often installed, with the sole purpose of downloading additional malware.In this context, we establish which user profile is targeted by cybercriminals, by identifying the link between the infected user's characteristics and the malware downloaded by the downloader.For that purpose, we build an automated testing framework to run and analyze malicious downloaders, using virtual machines with varying characteristics.It helped us identify which feature of a vii machine impacts the behavior of a family of downloader, i.e., what family and type of malware is sent to the downloader when run on a different virtual machine.Thus, we provide valuable new insights into the behavior and inner workings of the sale of infected machines.Our results first show that users form communities on social networks centered around specific topics of discussion, and that these can be identified, through a combination of natural language processing and graph clustering methods.These have been employed successfully in a classifier to predict malicious messages, by leveraging the path that these messages take through them.Our model, trained on a dataset of 1.3M messages collected from the Twitter social network, obtains high precision and recall and is effective at identifying spam messages.Second, our analysis of web redirection chains leading to exploit kits provides some insights into the campaigns associated with various exploit kits through time.We show that some exploit kit families can be identified with high accuracy according to their web redirection chains.We also observe that other families can only be identified when considering the time, hinting at the fact that the exploit kit is used in a single campaign in time.Finally, we build an automated testing framework for malicious binaries, where the location, the operating system, the browser session, the keyboard layout and the display language are configurable in order to identify the key features affecting the behavior of the tested binary.Using this framework, we present a 12-month period of malicious downloader experimentation, where the characteristics of the machine running the malicious downloader is linked to the downloaded payload.Using variance analyses and changepoint detection on time series of our machine infections, we identify multiple features of the machine profiles linked to specific malicious payload families.

Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.