Study and implementation of malWASH for its effectiveness against dynamic antivirus detection

Mgr. Niraj Kalra

Master's thesis

Abstract:

malWASH is a new framework proposed by the security researcher that works on the concept of chopping the malware binary to hide malicious signature into multiple benign processes. In this thesis, we analyze the implementation challenges of malWASH and suggest mechanisms to overcome these. We highlight the significant limitations in the active implementation of malWASH on live targets. This thesis extends malWASH, proposes and implements a modified framework called Fully Undetectable Malware Architecture (FUMA). The improved version would completely evade antivirus dynamic analysis and also provide target process independent malware execution on the victim system. Thesis content may be useful for security researchers to develop proposals to counter possible malWASH evasion.

Abstract:

malWASH is a new framework proposed by the security researcher that works on the concept of chopping the malware binary to hide malicious signature into multiple benign processes. In this thesis, we analyze the implementation challenges of malWASH and suggest mechanisms to overcome these. We highlight the significant limitations in the active implementation of malWASH on live targets. This thesis extends malWASH, proposes and implements a modified framework called Fully Undetectable Malware Architecture (FUMA). The improved version would completely evade antivirus dynamic analysis and also provide target process independent malware execution on the victim system. Thesis content may be useful for security researchers to develop proposals to counter possible malWASH evasion.

Keywords

antivirus evasion, dynamic analysis, fileless malware, FUMA, in-memory decryption, injection techniques, malWASH

Language used: English

Date on which the thesis was submitted / produced: 13. 12. 2018

Thesis defence

• Date of defence: 31. 1. 2019
• Supervisor: prof. RNDr. Václav Matyáš, M.Sc.
• Reader: Ing. Mgr. et Mgr. Zdeněk Říha, Ph.D.

Masaryk University

Faculty of Informatics

Master programme / field:
Informatics / Information Technology Security (eng.)