Systems and methods for detecting scalable malware similarity via datastore of assembly-level malicious behavior implementations extracted from memory

A malware analysis system, comprising:

• a memory extraction engine configured to capture memory snapshots of malicious executables during dynamic execution based on behavioral anchor triggers;
• a gene extraction module configured to extract assembly-level behavioral implementations from the memory snapshots using targeted disassembly;
• a gene datastore configured to store the extracted assembly-level behavioral implementations;
• and
• a gene matching module configured to compare genes between malware samples and identify malware family relationships based on shared assembly-level implementations of malicious behaviors.

A computer-implemented method for detecting cross-family code sharing in malware, comprising:

• capturing temporal memory snapshots of a malicious executable across multiple execution stages;
• extracting genes representing assembly-level implementations of malicious behaviors from each temporal memory snapshot;
• analyzing temporal relationships between the genes across the execution stages to identify gene abandonment patterns;
• and
• classifying cross-family code sharing relationships based on the temporal relationships, wherein genes appearing in different execution stages indicate dropper-payload relationships between different malware families.