Citadel僵尸网络的逆向工程研究
On the Reverse Engineering of the Citadel Botnet
摘要：
Citadel是一种针对金融信息的高级信息窃取恶意软件。这种恶意软件对个人和商业数据的机密性和完整性构成了真正的威胁。联邦调查局和微软数字犯罪部门最近进行了一次联合行动，以摧毁Citadel的指挥和控制服务器。这次行动对僵尸网络造成了一些破坏，但并没有完全阻止它。由于Citadel恶意软件的复杂结构和先进的反逆向工程技术，Citadel恶意软件分析过程既具有挑战性又耗时。这使得网络犯罪分子可以在分析仍在进行的同时继续攻击。在本文中，我们将介绍Citadel逆向工程的结果，并提供对恶意软件的功能、内部工作原理和开源组件的进一步了解。为了加快逆向工程的进程，我们提出了一个基于克隆的分析方法。Citadel是以前分析过的名为Zeus的恶意软件的后代;因此，使用前者作为参考，我们可以测量和量化新变体的相似性和差异性。该方法提供了两种类型的代码分析技术，即汇编源代码匹配和二进制克隆检测。该方法可以帮助减少需要手动分析的功能的数量。分析结果表明，该方法在Citadel恶意软件分析中具有良好的应用前景。此外，相同的方法适用于类似的恶意软件分析场景。
英文摘要：
Citadel is an advanced information-stealing malware which targets financial information. This malware poses a real threat against the confidentiality and integrity of personal and business data. A joint operation was recently conducted by the FBI and the Microsoft Digital Crimes Unit in order to take down Citadel command-and-control servers. The operation caused some disruption in the botnet but has not stopped it completely. Due to the complex structure and advanced anti-reverse engineering techniques, the Citadel malware analysis process is both challenging and time-consuming. This allows cyber criminals to carry on with their attacks while the analysis is still in progress. In this paper, we present the results of the Citadel reverse engineering and provide additional insight into the functionality, inner workings, and open source components of the malware. In order to accelerate the reverse engineering process, we propose a clone-based analysis methodology. Citadel is an offspring of a previously analyzed malware called Zeus; thus, using the former as a reference, we can measure and quantify the similarities and differences of the new variant. Two types of code analysis techniques are provided in the methodology, namely assembly to source code matching and binary clone detection. The methodology can help reduce the number of functions requiring manual analysis. The analysis results prove that the approach is promising in Citadel malware analysis. Furthermore, the same approach is applicable to similar malware analysis scenarios.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
