Freeze Drying for Capturing Environment-Sensitive Malware Alive
summary
A system called Sweetspot implements freeze drying by suspending suspicious processes on an endpoint, serializing process context and heap with MessagePack, and reconstructing them in an analyzer to achieve process live migration. An i386 CPU-emulator sandbox holds execution state; API proxies fake VM/sandbox artifacts and provide dummy data. Demonstrations show a simple program migrated and resumed across hosts, but networking, media and several syscalls and process/thread creation remain unimplemented and real malware capture is not shown.
AI-written summary · about
chapters (5)
- 0:00Start
- 12:13Advanced Honeypot
- 12:35Process Migration
- 20:34Environment Awareness of Malware
- 31:40Demonstration
related talks
51mFull System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
44mSlime: Automated Anti-Sandboxing Disarmament System
45m"Advanced Malware Threat: handling obfuscated code using..."
37mDynamic Image Scanning Through System Tracing
01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized Packers
21mAutomating dynamic malware analysis
50mMTV Reboot — my Super Sweet 16-bit malware...
23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis