Towards Modeling Hidden & Steganographic Malware Communication based on Images

Recently, an increasing number of IT security incidents involving malware, which makes use of hidden and steganographic channels for malicious communication (a.k.a. as "stegomalware"), can be observed in the wild.Especially the use of images to hide malicious code is rising.In consideration of this shift, a new model is proposed in this paper, which aims to help security professionals to identify and analyze incidents revolving around steganographic malware in the future.The model focuses on practical aspects of steganalysis of communication data to elaborate linking properties to previous code analysis knowledge.The model features two distinct roles that interact with a knowledge base which stores malware features and helps building a context for the incident.For evaluation, two image steganography malware types are chosen from popular databases (malpedia and MITRE ATT&CK), which are analyzed in multiple steps including steganalysis and code analysis.It is conceptually shown, how the extracted features can be stored in a knowledge base for later use to identify stegomalware from communication data without the need of a thorough code analysis.This allows to uncover previously hidden meta-information about the examined malicious programs, enrich the incident's forensic context traces and thus allows for thorough forensic insights, including attribution and improved preventive security measures in the future.