Identificação automática de servidores C&C e identificação de variantes de malwares bashlite e mirai

Abstract

The Internet of Things is composed of a large number of devices dis- tributed around the world, and the weak security guarantees of many of these devices has been explored by malicious agents to build botnets. The impact of these botnets may be reduced by enabling security researchers to block access to the Command and Control servers. In this paper, we extend and integrate existing methods and tools into a framework for identifying C&C servers and grouping similar malware. We use static and dynamic analysis in combination with heuristics to infer C&C addresses, and clustering algorithms for grouping binaries by similarity. In our results, the proposed analyses and heuristics ex- tend the identification of C&Cs by mitigating countermeasures implemented by malware developers, while the clustering algorithm is able to group the binaries into meaningful groups, directing the efforts of security researchers.