Patent ID: 10176325

Abstract:
A system and method for dynamic detection of Command and Control (C&C) malware is provided. The method may include hooking API within an application and analyzing the code of the hooked API using static analysis. The method may further include conducting dynamic analysis; wherein incoming network and file content is collected and data patterns relating to C&C are detected from this content. Using these data patterns, this system may identify C&C URLs and further filter these URLs using C&C behaviors found during the dynamic analysis. For example, the system may detect when the code attempts to communicate with C&C servers or attempts to write to local files, which set up new C&C servers. Filtering of the C&C URLs may include detecting when the CRC URL intercepts an incoming SMS message or transmits a SMS; executes an abortBroadcast; or initiates collection of data leaked through to the network or the SMS.