Systems and methods for identifying detection-evasion behaviors of files undergoing malware analyses

Abstract

The disclosed computer-implemented method for identifying detection-evasion behaviors of files undergoing malware analyzes may include (1) monitoring, by a plurality of monitor components related to an automated execution environment, a file that is undergoing a malware analysis in the automated execution environment, (2) detecting a suspicious discrepancy among the monitor components with respect to computing activity observed in connection with the malware analysis by (A) identifying a monitor component that has observed the computing activity in connection with the malware analysis and (B) identifying another monitor component that has not observed the computing activity in connection with the malware analysis, and then (3) determining, based at least in part on the suspicious discrepancy, that the file demonstrates a detection-evasion behavior that led to the other monitor component not observing the computing activity in connection with the malware analysis. Various other methods, systems, and computer-readable media are also disclosed.