Investigating polymorphism for the D-TIME malware execution platform

Mgr. Ankur Lohchab

Master's thesis

Anotácia:

D-TIME, a new distributed threadless independent malware execution framework to evade runtime detection. It splits the malware executable into small chunks and executes one piece at a time in the context of an infected thread. It uses Microsoft Windows feature named Asynchronous Procedure Call (APC) to facilitate the chunk invocation, shared memory to coordinate the execution sequence of the chunk, and a novel Semaphore based Covert Broadcasting Channel (SCBC) to ensure communication between these fragments. In this thesis, we analyse and implement the D-TIME technique. The idea extends D-TIME, proposes and implements polymorphism in D-TIME. The improved Polymorphic D-TIME version would completely evade antivirus detection. We also carry out a comparative analysis of the original D-TIME and Polymorphic D-TIME techniques. The thesis could help the security researchers to develop possible countermeasures to prevent the Polymorphic D-TIME malware evasion.

Abstract:

D-TIME, a new distributed threadless independent malware execution framework to evade runtime detection. It splits the malware executable into small chunks and executes one piece at a time in the context of an infected thread. It uses Microsoft Windows feature named Asynchronous Procedure Call (APC) to facilitate the chunk invocation, shared memory to coordinate the execution sequence of the chunk, and a novel Semaphore based Covert Broadcasting Channel (SCBC) to ensure communication between these fragments. In this thesis, we analyse and implement the D-TIME technique. The idea extends D-TIME, proposes and implements polymorphism in D-TIME. The improved Polymorphic D-TIME version would completely evade antivirus detection. We also carry out a comparative analysis of the original D-TIME and Polymorphic D-TIME techniques. The thesis could help the security researchers to develop possible countermeasures to prevent the Polymorphic D-TIME malware evasion.

Keywords

Cryptolocker, D-TIME, Malware Evasion, Polymorphism, Virlock.

Jazyk práce: English

Datum vytvoření / odevzdání či podání práce: 18. 5. 2021

Obhajoba závěrečné práce

• Obhajoba proběhla 22. 6. 2021
• Vedúci: prof. RNDr. Václav Matyáš, M.Sc.
• Oponent: doc. RNDr. Petr Švenda, Ph.D.

Masaryk University

Faculty of Informatics

Master programme / odbor:
Computer Systems, Communication and Security (eng) / Information Security