A survey of similarities in banking malware behaviours

Abstract

Banking malware are a class of information stealing malicious software that target the financial industry. Banking malware families have become persistent with new versions being released by the original authors or by others using leaked source code. This paper draws together a fragmented and industry based literature to provide a coherent description of major banking malware families, their variants, relationships and source code leakages. The concept of malware behaviour is well established in the research literature. However, the literature has not settled on an identification of key malware behaviours. Malware behaviours are defined by existing standards, but they are broad in scope and some individual behaviours are not well defined. This paper identifies a set of malware behaviours that are present in the selected banking malware families. The conceptual distance between the low level detail of Application Programming Interface (API) calls and a high level understanding of malware behaviour is known as the semantic gap. This paper assembles a dataset of malware behaviours and then shows experimental use of the Pharos Framework to bridge this semantic gap by providing automatic identification of malware behaviour using static methods.