Malpedia Founder Daniel Plo hmann on Malware Analysis and Code Similarity
Summary
Daniel Plo hmann discusses his path into malware analysis, Malpedia’s curated malware-family data, and how MCRIT uses code similarity to support malware analysis, family identification, and rule generation.
Key points
- Plo hmann says Malpedia was created to organize malware-family information and samples and address inconsistent naming and disconnected research.
- Malpedia contributions are peer-reviewed; Plo hmann reviews binary content for consistency.
- MCRIT combines position-independent code hashing with MinHashing to identify identical and similar code.
- MCRIT’s code-frequency analysis can help highlight family-specific code, overlaps between malware families, and likely library code.
- MCRIT supports malware-family curation and can generate rules for code found across family samples but not elsewhere.
- Plo hmann says open-directory malware data and Hunt.io’s C2 infrastructure view help inform his research.
- He recommends perseverance and curiosity for people starting out in binary analysis.
Article Details
- Topic
- Interview on Daniel Plohmann’s malware research, Malpedia, MCRIT, and threat-research tools.
People
Malware
PlugXDaniel: There was a post last year on the Hunt.io blog, which featured the discovery of a PlugX builder in an open directory. As one of my current pet projects is to dig through the history of PlugX, this came in verywin.zeusDaniel: Having started roughly 15 years ago, I must highlight win.zeus as a family that has incurred so much family offspring that it certainly crossed my desk time and time again. In this case, it was particularly
Vendors
Products
MalpediaWhat inspired you to create Malpedia back in 2017? Was there a particular pain point or gap in the community that you felt needed to be filled?MCRITAs part of your PhD thesis, you developed MCRIT, which builds on concepts like Position Independent Code (PIC) hashing and MinHashing. Could you break down why these two approaches were the backbone of your framework?