Malware Analysis Sandbox Testing Methodology
Abstract
Manual processing of malware samples became impossible years ago. Sandboxes are used to automate the analysis of malware samples to gather information about the dynamic behaviour of the malware, both at AV companies and at enterprises. Some malware samples use known techniques to detect when it runs in a sandbox, but most of these sandbox detection techniques can be easily detected and thus flagged as malicious. I invented new approaches to detect these sandboxes. I developed a tool, which can collect a lot of interesting information from these sandboxes to create statistics how the current technologies work. After analysing these results I will demonstrate tricks to detect sandboxes. These tricks can’t be easily flagged as malicious. Some sandboxes don’t not interact with the Internet in order to block data extraction, but with some DNS-fu the information can be extracted from these appliances as well.References
N. Rin, EP_XOFF, Virtual Machines Detection Enhanced, 2013, https://github.com/hfiref0x/VMDE
Michael Boman, Making Virtualbox nearly undetectable, 2014 http://blog.michaelboman.org/2014/01/making-virtualbox-nearly-undetectable.html
William Metcalf, Cuckoo building scripts, 2015, https://github.com/wmetcalf/buildcuckoo-trusty
Jurriaan Bremer, "VMCloak, a tool for automatically creating and configuring Virtual Machines for Cuckoo Sandbox", 2015, http://jbremer.org/vmcloak2/
VirtualBox Anti-AntiVM, 2014, http://www.kernelmode.info/forum/viewtopic.php?f=11&t=1911
Peter Kleissner, AVTracker, http://avtracker.info/
SpiderLabs Research, Magnitude Exploit Kit Backend Infrastructure Insight - Part II, 2014, https://www.trustwave.com/Resources/SpiderLabs-Blog/Magnitude-Exploit-Kit-Backend-Infrastructure-Insight---Part-II/
Christian Amman, Hyperion: Implementation of a PE-Crypter, Nullsecurity, 2012, https://github.com/nullsecuritynet/papers/raw/master/nullsec-pe-crypter/nullsec-pe-crypter.pdf
James Wyke, Duping the machine - malware strategies, post sandbox detection, 2015, https://www.virusbtn.com/virusbulletin/archive/2015/01/vb201501-duping
Ben Baker, Alex Chiu, Threat Spotlight: Rombertik – Gazing Past the Smoke, Mirrors, and Trapdoors, 2015, http://blogs.cisco.com/security/talos/rombertik
Kaspersky Labs' Global Research & Analysis Team, Animals in the APT Farm, 2015, https://securelist.com/blog/research/69114/animals-in-the-apt-farm/
Joe Giron, Bypassing FireEye, ToorCon 15, https://www.youtube.com/watch?v=wynvicPjRDk
Th4nat0s, No_Sandboxes, https://github.com/Th4nat0s/No_Sandboxes
hfiref0x, VBoxHardenedLoader, https://github.com/hfiref0x/VBoxHardenedLoader
Copyright (c) 2015 Zoltan Balazs

This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.