20.500.12556/RUL-124791 Razkrivanje zlonamerne zmaličene kode Revealing malicious obfuscated code Zlonamerna programska oprema lahko povzroči veliko škode. Pisci teh programov uporabljajo raznolike metode, ki skrijejo njihov program in okužijo ciljni sistem. Uporabljajo različne metode prikrivanja delovanja, ki nam otežijo analizo. Poleg tega običajno nimamo dostopa do njihove izvorne kode. To zaplete analizo in zahteva bolj specializirano znanje. Pomembno je, da poznamo delovanje zlonamerne programske opreme. S tem lahko omejimo širjenje in zmanjšamo nadaljnjo škodo. Pri tej diplomski nalogi bomo izpostavili nekaj osnovnih metod analize in analizirali konkretni zmaličen zlonamerni program. Opisali bomo statično in dinamično metodo analize ter orodja, ki jih pri tem uporabljamo. Analizirali bomo zlonamerno programsko operemo DarkComet, ki je bila zmaličena z uporabo ASProtect pakirnika. Malware can cause a lot of damage. Writers of these programs use a variety of methods that hide their program and infect the target system. They use different obfuscation methods that make their analysis difficult. In addition, we usually do not have access to their source code. This complicates the analysis and requires more specialized knowledge. It is important to know how malware works. This can limit the spread and reduce further damage. In this thesis, we will highlight some basic methods of analysis and analyze a real obfuscated malware. We will describe static and dynamic methods of analysis and the tools that are used for each of them. We will analyze the DarkComet malware, which was obfuscated using ASProtect packer. zlonamerna koda obratni inženiring x86 zbirnik ASProtect DarkComet malicious code reverse engineering x86 assembly ASProtect DarkComet true false false Slovenski jezik Angleški jezik Diplomsko delo/naloga 2021-02-18 12:25:02 2021-02-18 12:25:06 2024-04-02 09:26:04 0000-00-00 00:00:00 2021 0 0 0000-00-00 NiDoloceno NiDoloceno NiDoloceno 0000-00-00 0000-00-00 0000-00-00 26525 52393731 Janhar_Nejc_-_Razkrivanje_zlonamerne_zmalicene_kode.pdf Janhar_Nejc_-_Razkrivanje_zlonamerne_zmalicene_kode.pdf 1 D384AE4514CB23C5932F0DD21E728020 dfb0fc25ca5a358cd234463b3199c1712b3daf63c38bf40b6b611f7b68240650 9fe656d9-a1bb-11eb-a523-00155dcfd717 https://repozitorij.uni-lj.si/Dokument.php?lang=slv&id=140399 Fakulteta za računalništvo in informatiko 0 0 0