Systems and methods for detecting geolocation-aware malware

A system for detecting geolocation-aware malware, the system comprising:

• a memory device;
• a receiving module, stored in the memory device, that receives trajectory information for network traffic carrying the geolocation-aware malware, wherein the trajectory information comprises paths intended to be taken by the network traffic carrying the geolocation-aware malware;
• an identifying module, stored in the memory device, that identifies, from the trajectory information, a target geolocation characteristic required to activate the geolocation-aware malware;
• an establishing module, stored in the memory device, that establishes, on an image of a user machine, an execution environment having the target geolocation characteristic;
• a running module, stored in the memory device, that runs the geolocation-aware malware on the image of the user machine;
• an analyzing module, stored in the memory device, that analyzes functioning of the geolocation-aware malware to identify malicious activity by the geolocation-aware malware;
• and
• at least one physical processor that executes the receiving module, the identifying module, the establishing module, the running module, and the analyzing module.

A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• receive trajectory information for network traffic carrying geolocation-aware malware, wherein the trajectory information comprises paths intended to be taken by the network traffic carrying the geolocation-aware malware;
• identify, from the trajectory information, a target geolocation characteristic required to activate the geolocation-aware malware;
• establish, on an image of a user machine, an execution environment having the target geolocation characteristic;
• run, on the image of the user machine, the geolocation-aware malware;
• and
• analyze functioning of the geolocation-aware malware to identify malicious activity by the geolocation-aware malware.