The master’s thesis provides a theoretical overview of malicious software (malware), along with the development of a custom malware sample and the evaluation of detection capabilities for malware mechanisms.
It highlights the most prominent types of malicious software, including ransomware, spyware, fileless malware, trojans, worms, viruses, botnets, logic bombs, and hybrid forms, as well as their most well-known representatives. The thesis also examines common malware mechanisms, such as privilege escalation, data theft and manipulation, persistence, remote control, evasion of detection, and destructive actions. Furthermore, various malware detection methods are analysed, including signature-based detection, static and dynamic analysis, and EDR (Endpoint Detection and Response)/XDR (Extended Detection and Response) systems.
In the practical section, a prototype malware sample was implemented, containing the following mechanisms: file encryption, establishment of a reverse-shell connection, registry modification, self-replication, and delayed execution. This sample was tested in an isolated laboratory environment using various free and commercial (professional/industrial) security tools, and the effectiveness of their detection was evaluated.
The results were both surprising and concerning, as neither free nor commercial antivirus solutions nor EDR/XDR systems were successful in detecting a relatively simple zero-day malware sample. Most of the tested solutions were able to detect individual mechanisms, yet none achieved 100% accuracy. This clearly demonstrates that such tools cannot be fully relied upon for the initial detection of new malware, and that files or applications that are unverified or suspected to be malicious should not be opened or executed. If opening/running such files cannot be avoided, they must be additionally examined or tested within a secure environment.
|
