Detecting malware based on address ranges

A method, comprising:

• providing, by a distribution computer system, program instructions to a set of computer systems, wherein the program instructions are executable by a given one of the set of computer systems to perform operations comprising:
• determining a set of valid address ranges for software modules associated with a particular process, wherein each of the set of valid address ranges defines a segment of a memory space allocated in memory of the given computer system for the particular process in which program instructions for a software module are stored;
• accessing information indicating a start address for a thread allocated for execution on the given computer system, wherein the start address identifies a location in the memory of the given computer system from which an initial program instruction is to be retrieved in order to begin execution of the thread;
• and
• based on the identified location being within the memory space allocated for the particular process, but not within any of the set of valid address ranges, determining to include information associated with the thread in a report to be sent to the distribution computer system;
• receiving, by the distribution computer system, the report from the given computer system;
• and
• determining, by the distribution computer system based on the information associated with the thread, whether to classify the thread as malware.

A non-transitory computer-readable medium having program instructions stored thereon that are executable by a computer system to perform operations comprising:

• accessing information that indicates a start address of a thread executing on the computer system, wherein the thread is associated with a process, and wherein the start address identifies a particular location in a memory of the computer system from which an initial program instruction is to be retrieved in order to begin execution of the thread;
• determining a set of valid address ranges for software modules associated with the process, wherein each of the set of valid address ranges is based on a base address of a respective software module and a memory size of that respective software module;
• and
• making an assessment on whether to classify the thread as being associated with malicious activity, wherein the assessment is based on the particular location and the set of valid address ranges.