Authors: Joe Bartelmo, Robert Suter, Andrew Botschagow
ARM is a proof of concept for forensics tools to show how malware can manifests itself across the Windows operating system. It will not contain a malware payload. Rather, if it's present it will simply write an artifact to the computer.
Ultimatley the point of this application is to help forensic investigators understand the difficulties in discovery of malicious content across the operating system.
ARM will have several key functions:
- Anti fuzzy hashing -- Uses UPX to pack the executable and change it's hash signatures, also does analysis to show the hashes have changed.
- File system Redundancy -- malware will do a simple storage of itself in directories that are not clearly evident to the user (temp/prefetch (if possible)/ sys32 / etc...)
- Slack space redundancy -- the malware will attempt to store itself across multiple slack spaces (or 1 large slack space) on the drive
- Unallocated space redundancy -- the malware will attempt to store itself in an unallocated section of the hard drive
- Encrypted Redundancy -- the malware will encrypt itself using multiple algorithms under different sections of the drive ( all of the listed)
- ADS redundancy (hiding in data of another file) -- the malware will obscure itself within an alternative data stream to hide from plain sight
- This malware will have a centralized launch from services to establish redundancy at a fixed time or when a user action occurs -- currently undecided on how this will trigger
- Registry redundancy, will attempt to obscure itself in the registry
We plan on having a main entry point that will allow a set of options to manifest itself.
MIT
- UPX Packager
- MD5 , md5 is not included with C++
- SHA1 , sha1 is not included with C++