Investigating polymorphism for the D-TIME malware execution platform

Mgr. Ankur Lohchab

Master's thesis

Abstract:

D-TIME, a new distributed threadless independent malware execution framework to evade runtime detection. It splits the malware executable into small chunks and executes one piece at a time in the context of an infected thread. It uses Microsoft Windows feature named Asynchronous Procedure Call (APC) to facilitate the chunk invocation, shared memory to coordinate the execution sequence of the chunk, and a novel Semaphore based Covert Broadcasting Channel (SCBC) to ensure communication between these fragments. In this thesis, we analyse and implement the D-TIME technique. The idea extends D-TIME, proposes and implements polymorphism in D-TIME. The improved Polymorphic D-TIME version would completely evade antivirus detection. We also carry out a comparative analysis of the original D-TIME and Polymorphic D-TIME techniques. The thesis could help the security researchers to develop possible countermeasures to prevent the Polymorphic D-TIME malware evasion.

Abstract:

D-TIME, a new distributed threadless independent malware execution framework to evade runtime detection. It splits the malware executable into small chunks and executes one piece at a time in the context of an infected thread. It uses Microsoft Windows feature named Asynchronous Procedure Call (APC) to facilitate the chunk invocation, shared memory to coordinate the execution sequence of the chunk, and a novel Semaphore based Covert Broadcasting Channel (SCBC) to ensure communication between these fragments. In this thesis, we analyse and implement the D-TIME technique. The idea extends D-TIME, proposes and implements polymorphism in D-TIME. The improved Polymorphic D-TIME version would completely evade antivirus detection. We also carry out a comparative analysis of the original D-TIME and Polymorphic D-TIME techniques. The thesis could help the security researchers to develop possible countermeasures to prevent the Polymorphic D-TIME malware evasion.

Keywords

Cryptolocker, D-TIME, Malware Evasion, Polymorphism, Virlock.

Language used: English

Date on which the thesis was submitted / produced: 18. 5. 2021

Thesis defence

• Date of defence: 22. 6. 2021
• Supervisor: prof. RNDr. Václav Matyáš, M.Sc.
• Reader: doc. RNDr. Petr Švenda, Ph.D.

Masaryk University

Faculty of Informatics

Master programme / field:
Computer Systems, Communication and Security (eng) / Information Security