Memory snapshot dataset of a compromised host with malware using obfuscation evasion techniques.

Area of Science:

• Computer Science
• Cybersecurity
• Digital Forensics

Background:

• Obfuscated malware poses a significant challenge in digital forensics.
• Detecting malware in volatile memory requires specialized datasets.
• Existing datasets may not adequately cover obfuscated malware techniques.

Purpose of the Study:

• To present a novel dataset for the detection of obfuscated malware in volatile memory.
• To facilitate research in memory forensics and malware analysis.
• To provide a benchmark for evaluating detection algorithms.

Main Methods:

• Generation of obfuscated reverse remote shells using Metasploit-Framework, Hyperion, and PEScrambler.
• Acquisition of memory snapshots from a Windows 10 virtual machine using Rekall's WinPmem.
• Inclusion of memory snapshots from uncompromised systems for baseline comparison.

Main Results:

• A comprehensive dataset containing memory snapshots of compromised and uncompromised systems.
• Detailed mapping of malware processes within the acquired memory.
• Reference data for all running processes in the virtual machine environment.

Conclusions:

• The presented dataset is valuable for advancing research in obfuscated malware detection.
• It supports the development and testing of forensic analysis tools for volatile memory.
• Availability of this dataset will accelerate progress in cybersecurity threat detection.