Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I am curious to know about how researchers can know when different malware are related. for example: Stuxnet, Flame or Duqu, are told to be written by the same group. Does anyone know how they figure that out?
I read some articles but they weren't very specific. They only said they were similar. Are there signatures that you can tell, or same style or language or what?
What are signs that 2 malware are related or come from same people???
Attribution is hard. However, you can see some specific snippets of code (in assembly) here and there that tells you that, possibly, the code was written by the same team. I, as for myself, consider graph matching a very trusted approach to determine if a malware is created by the same team and is what I typically use for this purpose.
Basically, graph matching works like this: if, once the files are completely unpacked, 2 or more binaries have a very similar call graph and very similar control flow graphs with only a few functions differing or only some basic blocks in one specific function or just some instructions in, say, one basic block somewhere, the files are likely created by the same team or author and is, likely, a new version of the same piece of software. Unless we're talking about virtual machines created with tools like Themida or VMProtect, this is commonly true.
This was the idea inspiring the (not public any more) product VxClass created by Zynamics or the CAMAL clustering engine I wrote myself (examples here and here). If you prefer to read an Open Source approach for doing exactly this, I recommend you to take a look to GCluster. This is a command line based tool using the Pyew API for clustering 2 or various unpacked malware files (PE and ELF executables) to determine how similar are them.
You can also use, as pointed out by @Mick, Yara signatures or fuzzy hashes based on the binary contents (bytes). However, they're likely going to create a big number of false positives (you're considering the bytes and finding for byte-streams, not comparing the structure of the executables as graph matching does).
Many people use tools like Yara and ssdeep to find commonalities among binaries. Typically they are looking for known code reuse, which would indicate that the malware may have shared some or all of the same source code.
For example, if I write a function to inject shellcode into a process, it will likely differ at least slightly from someone else attempting the same task. So if a researcher finds my compiled code in several binaries, it's reasonable to suspect my code was reused.
