How do you compare malware samples from different campaigns?

1 Static analysis

Static analysis is the process of examining the malware sample without executing it, using tools such as disassemblers, hex editors, and strings extractors. Static analysis can help you compare malware samples by revealing their file properties, code structure, embedded resources, and indicators of compromise (IOCs). For example, you can compare the file hashes, signatures, metadata, imports, exports, and strings of different samples to identify similarities and differences. Static analysis can also help you detect obfuscation and encryption techniques used by malware authors to evade detection and analysis.

2 Dynamic analysis

Dynamic analysis is the process of executing the malware sample in a controlled environment, such as a virtual machine or a sandbox, and monitoring its behavior, network activity, and system changes. Dynamic analysis can help you compare malware samples by showing their runtime characteristics, such as process creation, file modification, registry alteration, and network communication. For example, you can compare the command and control (C2) servers, protocols, payloads, and encryption keys of different samples to determine their origin, purpose, and functionality. Dynamic analysis can also help you capture and analyze the malware's memory and unpacked code.

3 Code analysis

Code analysis is the process of reconstructing the logic and functionality of the malware sample from its binary or assembly code, using tools such as debuggers, decompilers, and IDA Pro. Code analysis can help you compare malware samples by revealing their algorithms, data structures, variables, and functions. For example, you can compare the code patterns, logic flows, function names, and variable names of different samples to identify common or unique features. Code analysis can also help you understand the malware's capabilities, such as persistence, evasion, encryption, and exploitation.

4 Malware clustering

Malware clustering is the process of grouping malware samples based on their similarity or dissimilarity, using techniques such as machine learning, graph theory, and fuzzy hashing. Malware clustering can help you compare malware samples by providing a high-level overview of their relationships, families, and variants. For example, you can use tools such as Malpedia, YARA, or ssdeep to cluster malware samples based on their metadata, code signatures, or fuzzy hashes. Malware clustering can also help you discover new or unknown malware samples and track their evolution over time.

5 Malware attribution

Malware attribution is the process of linking malware samples to their authors, operators, or sponsors, using techniques such as code reuse, linguistic analysis, and threat intelligence. Malware attribution can help you compare malware samples by providing insights into their motives, objectives, and targets. For example, you can use tools such as Maltego, VirusTotal, or ThreatConnect to attribute malware samples based on their IOCs, C2 servers, or threat actors. Malware attribution can also help you assess the level of sophistication, resources, and skills of the malware authors and operators.