Abstract: A computer system generates a hierarchical evolutionary tree of digests of sample files. The digests are generated using a locality sensitive hashing function. The digests are grouped into several clusters, and the clusters are grouped into several nodes. The nodes are connected in hierarchical order to generate the hierarchical evolutionary tree. A digest of a file being evaluated for malware is generated using the locality sensitive hashing function. The digest is put in a cluster of the hierarchical evolutionary tree having digests that are most similar to the digest relative to digests of other clusters of the hierarchical evolutionary tree. The digest is identified to be of the same malware family as the digests of the cluster.

Abstract: One embodiment relates to a computer-implemented method of detecting a malware downloader running on a computer system. An indication is received that a process running on the computer system is attempting to execute an executable file. A timestamp of the executable file is obtained. The timestamp indicates a time at which the executable file was downloaded. A current time is also obtained from the computer system. A determination is made as to whether the current time is approximately equal to the time indicated by the timestamp. An indication is made that said process is not a malware downloader if the current time is not approximately equal to the time indicated by the timestamp. Another embodiment relates to a computer apparatus configured to detect a malware downloader. Other embodiments, aspects and features are also disclosed.