Using Clone Detection for Finding Signatures of Malware Families: A Case Study on FinSpy

Kurzfassung

Code reuse is a frequent practice in malware development and finding code similar to known malware can thus be a promising strategy for malware detection. In this paper, we analyze the use of the clone detector StoneDetector for finding Android malware. To this end, signatures of known malware are generated and used to look for suspicious code fragments in Android APK packages. Feasibility of the approach is shown for a case study on samples of the FinSpy malware family.