Any.Run – An Online Malware Analysis Tool

[BoraMurdar]

Any.Run is based out of Russia; it was founded in 2016 by security researcher Alexey Lapshin. His team now comprises of five developers who work on advancing the platform. What makes this tool unique from other sandbox analysis tools is that it is totally interactive. It basically implies, that instead of uploading a file and waiting for a sandbox to spit out a report, Any.Run allows the users to simply upload a file and have real-time interactions with the sandbox while it analyses the file. Note, no installation is needed.

Simply put, Any.Run allows you to interactively watch the investigation process and make adjustments when needed, just like you would do it on a real system, rather than depending on automated sandbox.

Using Any.Run is very simple.

Step 1 – Click On New Task
First, click on the new task icon which displays on basic task dialog.

Step 2 – Set Up A New Analysis Task
The users can set up a new task by going to the advanced mode to:

1. Select the file or URL that needs to be analyzed
2. Select the operating system (Windows 7/8.1/10) for the sandbox
3. Choose connectivity options
4. Select software that should be preloaded
5. Define the duration of the interactive session

Step 3: Launch Sandbox
Click the ‘Run” button when ready. Any.Run will start building the configured environment, display the sandbox environment which the users can interact with, and then launch the requested program.

Step4: Monitor Application Activity

Once launched, the users can interact with the desktop, click on buttons, open the start menu, user browsers, open the registry editor, open task manager, and run applications just like they would normally do. The only difference is that the sandbox would record all the network requests, process calls, file activity, and registry activities.

This way users can view any network requests, processes being created, and file activity in real-time. For detailed network request information, users can click on it to see the request and the response. Users can also click on a launched process to see which files have been modified, what registry changes were made, which libraries were used, and more.

Any.Run’s Free Community Version Has A Few Limitations

• It only supports Windows 7 32-bit as a virtual environment, this means users cannot use it to analyze the behavior of 64-bit files in that version.
• The maximum file size is set to 16 Megabyte
• Any file that is uploaded to the service can be downloaded by anyone, making confidentiality an issue.

Irrespective of the fact that Any.Run has few limitations it still is a good option for those who want to analyze few files before they can run it on their own machines.

 

[Deleted member 65228]

I've been using this service on and off recently, and it isn't all that bad at all - I'm sure it'll be improved even further as time goes by. I've also noticed a rise in its usage of the service among malware analysts in the InfoSec community over the past few weeks.

I'm not a fan of Hybrid-Analysis, Malwr is temporarily gone and likely won't return any-time soon and manual analysis when you have a lot of samples to go through can be really time consuming so this service can be quite beneficial.

@silversurfer @Der.Reisende - you may be interested in this.

 

[BoraMurdar]

I've been using this service on and off recently, and it isn't all that bad at all - I'm sure it'll be improved even further as time goes by. I've also noticed a rise in its usage of the service among malware analysts in the InfoSec community over the past few weeks.

I'm not a fan of Hybrid-Analysis, Malwr is temporarily gone and likely won't return any-time soon and manual analysis when you have a lot of samples to go through can be really time consuming so this service can be quite beneficial.

@silversurfer @Der.Reisende - you may be interested in this.

Wasn't aware until a few hours ago. Interesting idea for a site.

 

[Der.Reisende]

I've been using this service on and off recently, and it isn't all that bad at all - I'm sure it'll be improved even further as time goes by. I've also noticed a rise in its usage of the service among malware analysts in the InfoSec community over the past few weeks.

I'm not a fan of Hybrid-Analysis, Malwr is temporarily gone and likely won't return any-time soon and manual analysis when you have a lot of samples to go through can be really time consuming so this service can be quite beneficial.

@silversurfer @Der.Reisende - you may be interested in this.

It’s a really cool service, stumbled across one or two months ago (mostly in order to pull the sample).
It’s kinda Video demonstration utility for malware.
Best thing it’s free

• Any file that is uploaded to the service can be downloaded by anyone, making confidentiality an issue.

This is why we might not be allowed to use it in the Malware HUB.

But thank you @Opcode bringing this solution up, I sometimes have malware rebooting the system, being not able to trace it in Shadow Defender.
Did not have this service in my mind
It will be very useful for reporting bypasses to AV vendors (currently QuickHeal).
Much more helpful than just putting the Hybrid link into report.

 

[Deleted member 65228]

I'm still using Any.Run after all these weeks, I like the service a lot. I find it quite useful since it allows you to download other people's uploaded samples as well without a biased vetting procedure.

 

[ido montia]

Thank you!! good site!