Systems and methods for detecting malware variants

A system for detecting malware variants, the system comprising:

• an identification module programmed to identify an application package file comprising at least one class file;
• an unpacking module programmed to extract a set of metadata fields stored within the class file from the class file;
• a comparison module programmed to compare the set of metadata fields stored within the class file with the set of metadata fields stored within a corresponding class file found in a known malware package to determine a similarity between the application package file and the known malware package by:
• for each metadata field within the set of metadata fields:
• assigning a weight to the metadata field;
• applying a similarity metric to the metadata field;
• applying the weight to a result of the similarity metric and including the weighted result in a summation of weighted results for the set of metadata fields;
• a determination module programmed to determine, based on the similarity between the application package file and the known malware package, that the application package file is a threat variant in a same threat family as the known malware package;
• at least one processor configured to execute the identification module, the unpacking module, the comparison module, and the determination module.

A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• identify an application package file comprising at least one class file;
• extract a set of metadata fields stored within the class file from the class file;
• compare the set of metadata fields stored within the class file with the set of metadata fields stored within a corresponding class file found in a known malware package to determine a similarity between the application package file and the known malware package by:
• for each metadata field within the set of metadata fields:
• assigning a weight to the metadata field;
• applying a similarity metric to the metadata field;
• applying the weight to a result of the similarity metric and including the weighted result in a summation of weighted results for the set of metadata fields;
• determine, based on the similarity between the application package file and the known malware package, that the application package file is a threat variant in a same threat family as the known malware package.