I was working on a piece of malware for a Rendition Infosec client recently and noticed a novel malware sandbox evasion. Malware often tries to determine if it's in a sandbox and if so, performs different functions than when it is on an endpoint system.
This particular malware enters a loop and tries to connect to www.google.com. If the malware connects successfully, it goes on and does bad things. If not, it sleeps and does it again. And again. And again. Good news for sandbox evasion: until the malware successfully connects to Google, there's no way that you'll see anything bad. For this (and other) reasons, this malware had really low detection and had no trouble bypassing antivirus on the client's system.
The attacker knows however that tools like FakeDNS and a simple HTTP server could easily trick the malware into thinking it was on the Internet. But here the attacker reads the data returned and checks the first four bytes of the return to find "<!do". This string is likely the "<!doctype html>" tag that is found at the start of the Google website (and others). I checked a few sandbox programs that try to mimic the Internet and most of them just serve up an HTML page without the "<!doctype html>" tag. I'd recommend adding this to your sandbox program if your sandbox is configurable.
This is a great time to remind everyone that sandboxes are useful tools but are no replacement for a good reverse engineer. If you don't have a dedicated reverse engineering staff but would like to have the capability at your disposal, talk to us at Rendition Infosec and we can get you up and running on a retainer quickly. Once you have a reverse engineering capability at your disposal, it's pretty amazing how much you'll actually use it.
This particular malware enters a loop and tries to connect to www.google.com. If the malware connects successfully, it goes on and does bad things. If not, it sleeps and does it again. And again. And again. Good news for sandbox evasion: until the malware successfully connects to Google, there's no way that you'll see anything bad. For this (and other) reasons, this malware had really low detection and had no trouble bypassing antivirus on the client's system.
The attacker knows however that tools like FakeDNS and a simple HTTP server could easily trick the malware into thinking it was on the Internet. But here the attacker reads the data returned and checks the first four bytes of the return to find "<!do". This string is likely the "<!doctype html>" tag that is found at the start of the Google website (and others). I checked a few sandbox programs that try to mimic the Internet and most of them just serve up an HTML page without the "<!doctype html>" tag. I'd recommend adding this to your sandbox program if your sandbox is configurable.
This is a great time to remind everyone that sandboxes are useful tools but are no replacement for a good reverse engineer. If you don't have a dedicated reverse engineering staff but would like to have the capability at your disposal, talk to us at Rendition Infosec and we can get you up and running on a retainer quickly. Once you have a reverse engineering capability at your disposal, it's pretty amazing how much you'll actually use it.
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.