Skip to Main content Skip to Navigation
Conference papers

Gorille sniffs code similarities, the case study of Qwerty versus Regin

Guillaume Bonfante 1 Jean-Yves Marion 1 Fabrice Sabatier 1
1 CARTE - Theoretical adverse computations, and safety
Inria Nancy - Grand Est, LORIA - FM - Department of Formal Methods
Abstract : In the last decade, our group has developed a tool called Gorille which implements morphological analysis, roughly speaking control graph comparison of malware. Our first intention was to use it for malware detection, and this works quite well as already presented in [2]. However , morphological analysis outputs a more refine output than 'yes' or 'no'. In the current contribution, we show that it can be used in several ways for retro-engineering. First, we describe a rapid triggering process that enlighten code similarities. Second, we present a function identification mechanism which aim is to reveal some key code in a malware. Finally, we supply a procedure which separate different families of code given some samples. All these tasks are done (almost) automatically seen from a retro-engineering perspective.
Document type :
Conference papers
Complete list of metadata

Cited literature [7 references]  Display  Hide  Download

https://hal.inria.fr/hal-01263123
Contributor : Guillaume Bonfante <>
Submitted on : Wednesday, January 27, 2016 - 1:58:25 PM
Last modification on : Thursday, November 5, 2020 - 3:02:25 PM
Long-term archiving on: : Thursday, April 28, 2016 - 11:22:05 AM

File

malware2015.pdf
Files produced by the author(s)

Identifiers

  • HAL Id : hal-01263123, version 1

Collections

Citation

Guillaume Bonfante, Jean-Yves Marion, Fabrice Sabatier. Gorille sniffs code similarities, the case study of Qwerty versus Regin. Malware Conference, Oct 2015, Fajardo, Puerto Rico. pp.8. ⟨hal-01263123⟩

Share

Metrics

Record views

601

Files downloads

1854