6th European Conference - Academic Conferences
6th European Conference - Academic Conferences
6th European Conference - Academic Conferences
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Madhu Shankarapani and Srinivas Mukkamala<br />
Figure 4: Opcode instructions with entry points for the Trojan with custom made Zeus builder<br />
According to our observations though these two Trojans were created using different packers, their<br />
characteristics of using Windows API are almost similar. We observed the API call sequence of both<br />
the Trojans. When we applied distance measures after its API sequence alignment between them, we<br />
found they are about 92.32% similar to each other. This shows that irrespective of the obfuscation<br />
method used to create Zeus variants; our methodology can detect these Trojans.<br />
4. Analysis methodology<br />
First, the Zeus sample is decompressed and passed through a PE file parser, producing the<br />
intermediate representation which consists of a Windows API calling sequence. This sequence is<br />
compared to a known malware sequence or signature (from the signature database) and is passed<br />
through the similarity measure module to generate the similarity report. The detection decision is<br />
made based on this similarity report. The PE binary parser transforms the PE binary file into an API<br />
calling sequence. It uses two components, W32Dasm version 8.9 and a text parser for disassembled<br />
code. W32Dasm by URSoftware Co. is a commercial disassembler, which disassembled the PE code<br />
and outputs assembly instructions, imported modules, imported API’s, and recourse information. The<br />
text parser parses the output from W32Dasm to a static API calling sequence, which becomes our<br />
signature.<br />
Table 1: Similarity analysis of Zeus/Zbot compared among different variants<br />
Tro<br />
jan.<br />
Troj<br />
Sp<br />
Troj an. Troj Troj<br />
Troj<br />
y.Z<br />
Troj an. Spy an.S an.S<br />
Troj<br />
an.<br />
eus Troj Troja an.B Zbo .Ze py.Z py.Z Troja Troja an.Z Spy.<br />
.1. an.Z n.Spy roke t- us. eus. eus. n.Zbo n.Spy bot- DHL Zeu<br />
Ge bot- .Zeus r- 134 1.G 1.Ge 1.Ge t- .Zeus 115 _DO s.1.<br />
n. 85. .2.Ge 12. 2.m en. n.m n.m 290. .1.Ge 1.m C.m Gen<br />
mal mal n.mal mal al mal al al mal n.mal al al .mal<br />
Trojan.Sp 10<br />
y.Zeus.1. 0.0 51.9<br />
92.3 70. 51. 71.2 60.9<br />
79.8 71.2 47.7<br />
Gen.mal 0 0 67.00 2 06 72 7 3 63.45 61.43 8 7 1<br />
Trojan.Zb 46. 100.<br />
51.2 58. 53. 70.3 52.4<br />
63.5 69.5 45.3<br />
ot-85.mal<br />
Trojan.Sp<br />
83 00 58.19 7 00 44 9 6 56.69 42.69 3 0 3<br />
y.Zeus.2. 41. 49.7 100.0 66.0 70. 66. 30.9 51.9<br />
58.4 61.0 53.9<br />
Gen.mal<br />
Trojan.Bro<br />
31 2 0 3 78 95 9 1 88.23 60.26 9 7 0<br />
ker- 49. 34.7<br />
100. 43. 52. 38.2 44.1<br />
64.6 44.0 38.8<br />
12.mal 59 3 47.55 00 98 98 7 7 47.82 45.79 6 3 1<br />
256
Change language