Statička i dinamička analiza zlonamjernih programa

master's thesis

• Title (english): Static and Dynamic Malware Analysis
• Author: Laura Dabelić
• Mentor: Marin Golub (mentor)
• Committee member: Marin Golub (predsjednik povjerenstva)
• Committee member: Stjepan Groš (član povjerenstva)
• Committee member: Dejan Škvorc (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2017-07-12, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Nove sigurnosne prijetnje pojavljuju se svakog dana i metode napada su sve kompleksnije. Potrebno je razviti nove metode zaštite i prevencije sigurnosnih napada. Važnu ulogu u tom procesu ima analiza zlonamjernih programa. Opisane su metode statičke i dinamičke analize od jednostavnijih ka složenijima. Svaka metoda analize potkrijepljena je konkretnim primjerom analize zlonamjernog programa. Naglasak u ovom radu stavljen je na analizu ucjenjivačkih programa. Prikazana je cjelokupna metoda analize ucjenjivačkog programa od ručnog raspakiravanja preko jednostavne statičke analize pa sve do napredne statičke i dinamičke analize korištenjem programa za ispravljanje pogrešaka. Opisane su razlike između simulatora i stvarnih ucjenjivačkih programa kao i postupak izrade otiska pomoću alata YARA.

Abstract (english)

New security threats emerge every day with newer and more complex methods of attacking. Development of new methods of prevention and protection is needed. Malware analysis plays an important role in that process. Methods of static and dynamic analysis are described from simple to more complex ones. Every method of analysis is followed by concrete example of malware analysis. In this thesis the emphasis has been on ransomware analysis. The complete ransomware analysis is shown, from manual unpacking and simple static analysis to advanced static and dynamic analysis with the debugger. Differences between simulator and actual ransomware are described along with making patterns using YARA tool.

• Keywords: zlonamjerni program; statička analiza; dinamička analiza; ucjenjivački program; YARA pravilo
• Keywords (english): malware; static analysis; dynamic analysis; ransomware; YARA rule
• Language: croatian
• URN:NBN: urn:nbn:hr:168:670406
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2019-03-13 19:52:37