Gorille sniffs code similarities, the case study of Qwerty versus Regin - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2015

Gorille sniffs code similarities, the case study of Qwerty versus Regin

Résumé

In the last decade, our group has developed a tool called Gorille which implements morphological analysis, roughly speaking control graph comparison of malware. Our first intention was to use it for malware detection, and this works quite well as already presented in [2]. However , morphological analysis outputs a more refine output than 'yes' or 'no'. In the current contribution, we show that it can be used in several ways for retro-engineering. First, we describe a rapid triggering process that enlighten code similarities. Second, we present a function identification mechanism which aim is to reveal some key code in a malware. Finally, we supply a procedure which separate different families of code given some samples. All these tasks are done (almost) automatically seen from a retro-engineering perspective.
Fichier principal
Vignette du fichier
malware2015.pdf (369.39 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01263123 , version 1 (27-01-2016)

Identifiants

  • HAL Id : hal-01263123 , version 1

Citer

Guillaume Bonfante, Jean-Yves Marion, Fabrice Sabatier. Gorille sniffs code similarities, the case study of Qwerty versus Regin. Malware Conference, Oct 2015, Fajardo, Puerto Rico. pp.8. ⟨hal-01263123⟩
402 Consultations
1088 Téléchargements

Partager

Gmail Facebook X LinkedIn More