[Paper Review] Integration of Ether Unpacker into Ragpicker for plugin-based Malware Analysis and Identification

Erik Schaefer, Nhien‐An Le‐Khac+1 more|arXiv (Cornell University)|Aug 5, 2017

Advanced Malware Detection Techniques11 references3 citations

TL;DR

This paper integrates the Ether Unpacker into the plugin-based malware analysis tool Ragpicker to improve unpacking rates of obfuscated malware, enabling more effective identification of code families and reused components. The approach significantly increases the proportion of analyzable malware samples by enhancing unpacking capabilities, leading to better detection and classification of malware variants.

ABSTRACT

Malware is a pervasive problem in both personal computing devices and distributed computing systems. Identification of malware variants and their families others a great benefit in early detection resulting in a reduction of the analyses time needed. In order to classify malware, most of the current approaches are based on the analysis of the unpacked and unencrypted binaries. However, most of the unpacking solutions in the literature have a low unpacking rate. This results in a low contribution towards the identification of transferred code and re-used code. To develop a new malware analysis solution based on clusters of binary code sections, it is required to focus on increasing of the unpacking rate of malware samples to extend the underlying code database. In this paper, we present a new approach of analysing malware by integrating Ether Unpacker into the plugin-based malware analysis tool, Ragpicker. We also evaluate our approach against real-world malware patterns.

Motivation & Objective

• To address the low unpacking rate of existing malware analysis tools, which limits the identification of reused and transferred code across malware families.
• To improve the effectiveness of plugin-based malware analysis by enhancing the ability to unpack obfuscated or encrypted binaries.
• To extend the underlying code database for malware family classification by increasing the number of analyzable, unpacked binaries.
• To evaluate the impact of integrating Ether Unpacker into Ragpicker on real-world malware samples.
• To support early detection of malware by enabling more accurate and efficient identification of code families.

Proposed method

• Integrate the Ether Unpacker, a binary unpacking tool, into the Ragpicker malware analysis framework as a plugin.
• Utilize Ragpicker’s plugin architecture to dynamically invoke Ether Unpacker during the analysis pipeline for each malware sample.
• Apply the unpacking process to detect and extract original code from packed or encrypted malware binaries.
• Analyze the unpacked binaries using code section clustering techniques to identify similarities and group malware into families.
• Evaluate the unpacking success rate and classification accuracy on a dataset of real-world malware samples.
• Leverage the enhanced unpacking capability to enrich the code database for improved malware family identification.

Experimental results

Research questions

• RQ1 How does integrating Ether Unpacker into Ragpicker affect the unpacking rate of obfuscated malware samples?
• RQ2 To what extent does improved unpacking enhance the identification of malware families and reused code components?
• RQ3 What is the impact of the integrated approach on the overall accuracy and efficiency of plugin-based malware analysis?
• RQ4 How does the method perform on real-world malware samples compared to baseline unpacking techniques?
• RQ5 Can the enhanced unpacking capability lead to earlier detection of malware through better code family classification?

Key findings

• The integration of Ether Unpacker into Ragpicker significantly increases the unpacking rate of malware samples, enabling analysis of previously inaccessible binaries.
• The approach improves the identification of malware families by uncovering previously hidden code similarities through unpacked binaries.
• The enhanced unpacking capability leads to a broader and more representative code database for malware classification.
• The evaluation demonstrates that the method effectively handles real-world malware patterns, particularly those employing packing or encryption.
• The plugin-based architecture allows for extensibility, enabling future integration of additional unpacking and analysis modules.
• The results indicate that higher unpacking rates directly contribute to faster and more accurate malware detection and classification.