Malware Behavior Capturing Based on Taint Propagation and Stack Backtracing

Although dynamic analysis is immune to polymorphic, metamorphic, and encryption techniques, it is an open issue how to precisely capture behavior of malware. A connection between system call and its module has been constructed using taint propagation and stack backtracing, and a method of capturing malware behavior is presented on the basis of this connection¹. This method works well on parasitic malware and the analysis results are more concise. Finally, a prototype Module-based Analysis Tool (MAT) on Windows XP has been implemented. The experimental results show that MAT can capture well behaviors of most kinds of malwares, and locate the real malicious module, which is very useful to remove malware.