PANDEMONIUM: Automated Identification of Cryptographic Algorithms
summary
A system called PANDEMONIUM runs malware under dynamic binary instrumentation (PANDA/QEMU), translates executed code into LLVM IR, applies llvm optimizations and symbolic execution, and builds per-basic-block fuzzy hashing signatures to match known crypto implementations. It targets banking trojans whose keys are embedded, extracts taint-propagated network-dependent blocks, and flags matches. Evaluation on eight real samples yields crypto identification in four (including Dyre‑style families) but fails on custom VM/obfuscated loaders; key extraction remains unimplemented.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:44Why identifying crypto in malware matters
- 3:14Malware types and crypto use cases
- 5:16Limitations of existing detection methods
- 6:21Malware analysis challenges
- 8:06PANDEMONIUM’s multi-technique approach
- 10:17Detecting malware in Windows XP
- 11:23Removing obfuscation with LLVM
- 12:33Fuzzy hashing for anti-analysis
- 14:29Symbolic execution bypass
- 17:08Taint analysis for data tracking
- 19:24Crypto ID with fuzzy hashing
- 20:58Experimental results on malware
- 22:45Method limitations and challenges
- 24:14Future directions
- 25:43Conclusion and Q&A
related talks
45m"Advanced Malware Threat: handling obfuscated code using..."
23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis
51mFull System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
55mHiding PIN's Artifacts to Defeat Evasive Malware
40mAnalyzing Windows Malware on Linux: Getting Started Tips and Examples
33mBasic Malware Analysis for Incident Responders
57mAnatomy of ... POS Malware
56mAutomating Linux Malware Analysis Using Limon Sandbox