Hacking Articles Tips Tricks Videos Tutorials

This project provides IoT malware similarity analysis based on shared codes. It helps to identify other malwares that have shared code with the analyzed file. In this way, you can have a chance to get an idea about the family of the malware. There are various devices with different architectures in the IoT ecosystem. Static-based methods are more effective when addressing the multi-architecture issue. 1000 malware binaries provided by IoTPOT (https://sec.ynu.codes/iot/) were used in the project. The basic blocks and functions of each of binaries were extracted by radare2 (https://www.kitploit.com/search/label/radare2) and the hash values of these data were stored in the SQL database. The basic blocks and functions of the sample to be analyzed are query from this database and all malwares that have shared code are listed.
Current featuresShared code based static analysis.Supporting ARM, MIPS, x86-64, i386, PowerPC, m68k, Renesas SH.?Getting StartedPrerequisitesPython3+Radare2 (https://github.com/radareorg/radare2)r2pipeInstallationgit clone https://github.com/mucoze/Umay
cd Umay
virtualenv venvsource venv/bin/activatepip install -r requirements.txtpython manage.py makemigrationspython manage.py migratepython manage.py createsuperuserpython manage.py runserverand now project app is accesible from your browser. Default: 127.0.0.1:8000Create your own dataset filepython create_dataset.py samples/Give the directory (https://www.kitploit.com/search/label/Directory) where all the samples are located as an argument and it will generate the dataset.db file for you.🤝 ContributingContributions, issues, and feature requests are welcome!Feel free to contact me.LicenseUmay is licensed under Apache License 2.0 (https://github.com/mucoze/Umay/blob/main/LICENSE)

Download Umay (https://github.com/mucoze/Umay)

10 views20:38

Umay - IoT Malware Similarity Analysis Platform

IoT Malware Similarity Analysis PlatformView Demo This project provides IoT malware similarity analysis based on shared codes. It helps to identify other malwares that have shared code with the analyzed file. In this way, you can have a chance to get an idea about the family of the malware. There are various devices with different architectures in the IoT ecosystem. Static-based methods are more effective when addressing the multi-architecture issue. 1000 malware binaries provided by IoTPOT were used in the project. The basic blocks and functions of each of binaries were extracted by radare2 and the hash values of these data were stored in the SQL database. The basic blocks and functions of the sample to be analyzed are query from this database and all malwares that have shared code are listed.Current featuresShared code based static analysis.Supporting ARM, MIPS, x86-64, i386, PowerPC, m68k, Renesas SH.?Getting StartedPrerequisitesPython3+Radare2r2pipeInstallationgit clone https://github.com/mucoze/Umaycd Umayvirtualenv venvsource venv/bin/activatepip install -r requirements.txtpython manage.py makemigrationspython manage.py migratepython manage.py createsuperuserpython manage.py runserverand now project app is accesible from your browser. Default: 127.0.0.1:8000Create your own dataset filepython create_dataset.py samples/Give the directory where all the samples are located as an argument and it will generate the dataset.db file for you.🤝 ContributingContributions, issues, and feature requests are welcome!Feel free to contact me.LicenseUmay is licensed under Apache License 2.0Download Umay
Read more...

13 views20:52

About

Blog

Apps

Platform