# US 10,771,482 B1 · Systems and methods for detecting geolocation-aware malware > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,482 B1 - Document ID: US10771482B1 - Status: Granted - Kind: B1 - Application number: 15/811,713 - Filed: 2017-11-14 - Granted: 2020-09-08 - Earliest claimed: 2017-11-14 - Assignees: CA, Inc. - Applicants: Ca, Inc. - Inventors: Prashant Gupta - Web page: https://patentgrep.com/patent/US10771482B1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The disclosed computer-implemented method for detecting geolocation-aware malware may include (1) receiving, by a computing device, trajectory information for network traffic carrying geolocation-aware malware, (2) identifying, from the trajectory information, a target geolocation characteristic required to activate the geolocation-aware malware, (3) establishing, on an image of a user machine, an execution environment having the target geolocation characteristic, (4) running, on the image of the user machine, the geolocation-aware malware, and (5) analyzing functioning of the geolocation-aware malware to identify malicious activity by the geolocation-aware malware. Various other methods, systems, and computer-readable media are also disclosed. ## Claims ### Claim 1 A computer-implemented method for detecting geolocation-aware malware, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: receiving, by the computing device, trajectory information for network traffic carrying the geolocation-aware malware, wherein the trajectory information comprises paths intended to be taken by the network traffic carrying the geolocation-aware malware; identifying, from the trajectory information, a target geolocation characteristic required to activate the geolocation-aware malware; establishing, on an image of a user machine, an execution environment having the target geolocation characteristic; running, on the image of the user machine, the geolocation-aware malware; and analyzing functioning of the geolocation-aware malware to identify malicious activity by the geolocation-aware malware. ### Claim 2 (depends on 1) The method of claim 1, wherein the trajectory information is received from an advanced threat protection platform. ### Claim 3 (depends on 1) The method of claim 1, wherein the trajectory information includes at least one of: a location of an advanced threat protection platform from which the trajectory information is received; a source of the network traffic; and a destination of the network traffic. ### Claim 4 (depends on 1) The method of claim 1, further comprising: receiving, from an advanced threat protection platform, information describing at least one of: location-specific hardware of a target of the network traffic; and location-specific software of the target of the network traffic; and identifying the target geolocation characteristic from the information describing at least one of: the location-specific hardware of the target of the network traffic; and the location-specific software of the target of the network traffic. ### Claim 5 (depends on 1) The method of claim 1, further comprising: receiving, from an advanced threat protection platform, information describing at least one of: a language setting of an operating system of a target machine; and a keyboard language of the target machine; and identifying the target geolocation characteristic from the information describing at least one of: the language setting of the operating system of the target machine; and the keyboard language of the target machine. ### Claim 6 (depends on 1) The method of claim 1, wherein running the geolocation-aware malware further includes: receiving a request, from the geolocation-aware malware, for geolocation-related information about a target machine; and providing, to the geolocation-aware malware, a falsified network response indicating the geolocation-related information about the target machine. ### Claim 7 (depends on 1) The method of claim 1, wherein running the geolocation-aware malware further includes: receiving a request, from the geolocation-aware malware, for an application program interface (API) response indicating geolocation-related information; and providing, to the geolocation-aware malware, a falsified API response indicating the geolocation-related information. ### Claim 8 (depends on 1) The method of claim 1, further comprising determining, using the identified malicious activity as a basis, at least one of: a signature of the geolocation-aware malware; a verdict that the geolocation-aware malware is not safe to run on a target machine; and a reputation of the geolocation-aware malware. ### Claim 9 (depends on 1) The method of claim 1, further comprising performing at least one security action in response to identifying malicious activity by the geolocation-aware malware. ### Claim 10 (depends on 1) The method of claim 1, further comprising: receiving information describing a time zone of the target machine; and identifying the target geolocation characteristic from the information describing the time zone of the target machine. ### Claim 11 A system for detecting geolocation-aware malware, the system comprising: a memory device; a receiving module, stored in the memory device, that receives trajectory information for network traffic carrying the geolocation-aware malware, wherein the trajectory information comprises paths intended to be taken by the network traffic carrying the geolocation-aware malware; an identifying module, stored in the memory device, that identifies, from the trajectory information, a target geolocation characteristic required to activate the geolocation-aware malware; an establishing module, stored in the memory device, that establishes, on an image of a user machine, an execution environment having the target geolocation characteristic; a running module, stored in the memory device, that runs the geolocation-aware malware on the image of the user machine; an analyzing module, stored in the memory device, that analyzes functioning of the geolocation-aware malware to identify malicious activity by the geolocation-aware malware; and at least one physical processor that executes the receiving module, the identifying module, the establishing module, the running module, and the analyzing module. ### Claim 12 (depends on 11) The system of claim 11, wherein the trajectory information is received from an advanced threat protection platform. ### Claim 13 (depends on 11) The system of claim 11, wherein the trajectory information includes at least one of: a location of an advanced threat protection platform from which the trajectory information is received; a source of the network traffic; and a destination of the network traffic. ### Claim 14 (depends on 11) The system of claim 11, wherein the receiving module receives, from an advanced threat protection platform, information describing at least one of: location-specific hardware of a target of the network traffic; and location-specific software of the target of the network traffic; and the identifying module identifies the target geolocation characteristic from the information describing at least one of: the location-specific hardware of the target of the network traffic; and the location-specific software of the target of the network traffic. ### Claim 15 (depends on 11) The system of claim 11, wherein the receiving module receives, from an advanced threat protection platform, information describing at least one of: a language setting of an operating system of a target machine; a keyboard language of the target machine; and the identifying module identifies the target geolocation characteristic from the information describing at least one of: the language setting of the operating system of the target machine; and the keyboard language of the target machine. ### Claim 16 (depends on 11) The system of claim 11, wherein running the geolocation-aware malware further includes: receiving a request, from the geolocation-aware malware, for geolocation-related information about a target machine; and providing, to the geolocation-aware malware, a falsified network response indicating the geolocation-related information about the target machine. ### Claim 17 (depends on 11) The system of claim 11, wherein running the geolocation-aware malware further includes: receiving a request, from the geolocation-aware malware, for an application program interface (API) response indicating geolocation-related information; and providing, to the geolocation-aware malware, a falsified API response indicating the geolocation-related information. ### Claim 18 (depends on 11) The system of claim 11, further comprising a determining module, stored in the memory device, that determines, using the identified malicious activity as a basis, at least one of: a signature of the geolocation-aware malware; a verdict that the geolocation-aware malware is not safe to run on a target machine; and a reputation of the geolocation-aware malware. ### Claim 19 (depends on 11) The system of claim 11, further comprising a performing module, stored in the memory device, that performs at least one security action in response to identifying malicious activity by the geolocation-aware malware. ### Claim 20 A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to: receive trajectory information for network traffic carrying geolocation-aware malware, wherein the trajectory information comprises paths intended to be taken by the network traffic carrying the geolocation-aware malware; identify, from the trajectory information, a target geolocation characteristic required to activate the geolocation-aware malware; establish, on an image of a user machine, an execution environment having the target geolocation characteristic; run, on the image of the user machine, the geolocation-aware malware; and analyze functioning of the geolocation-aware malware to identify malicious activity by the geolocation-aware malware. ### Claim 21 (depends on 20) The non-transitory computer-readable medium of claim 20, wherein the trajectory information includes at least one of: a location of an advanced threat protection platform from which the trajectory information is received; a source of the network traffic; and a destination of the network traffic.