Defeating Sandbox Evasion: How to Increase Successful Emulation Rate in your Virtualized Environment

[Av Gurus]

In the real world, special virtualized environments, called sandboxes, are used to analyse malware behaviour and prevent it from spreading and damaging real users' personal data, important corporate assets, etc. In our research, we focus on how to fight against the detection of sandboxes by malware and demonstrate some of the different techniques used by malware authors to detect virtual environments that are disregarded by leading vendors. We also present some solutions to counter these detection techniques.

We also discuss Cuckoo Sandbox, a leading open-source automatic malware analysis system that is widely used in the world of security. Cuckoo Sandbox is easy to deploy and contains features which perform many key aspects of malware analysis, such as collecting information about the malware behaviour, capturing network traffic, processing reports, and more. Nearly all the largest players on the market, including VirusTotal and Malwr, utilize Cuckoo Sandbox as a platform to perform automatic behavioural analysis. Cuckoo Sandbox can also be used as a backend for anti-malware-related projects. We describe Cuckoo Sandbox bugs, which allow malware to detect a sandboxed environment, as well as possible solutions for these issues.

Malware authors can use evasion techniques against a virtual environment simply by running some specially crafted code. If a sandbox is detected, then the malware may choose, for example, one of the following behaviours:

1. Terminate the execution, so no information will be provided.
2. Perform some non-malicious activity, so false information will be provided.
3. Perform some activities by accessing, for example, fake domains or IPs, to generate artifacts which are not relevant.

If false information is received and used in products, the endpoint users are not protected against threats. Proposed solutions will lead to increased successful emulation rate and delivery of more relevant information as well as contributing to the overall improvement of virtual environments, especially ones that use Cuckoo Sandbox.

 

[DardiM]

Thanks for the share

Both sides (malware and VM /Sandbox) seem to be engaged in an arm-wrestling contest. Some tricks to detect virtual environments, some methods against this detection... and I bet none of them will definitely win

(The same thing between AV/anti-Malware tools and Virus/Malware.
The same thing between Good and Evil ...
The same things between Wife and Husband...
The same thing between Parents and Children..)

 

[ravi prakash saini]

@DardiM ,you are right they both wrestle with each other but instead of beating each other they are beating us.it is definate that none of them will win,but it is also definate that in the process we are going to loose

 

[jamescv7]

Sandbox is powerful however threats nowadays are smarter.

Smarter where they can distinguish easily if it's isolated environment, then terminate alongside of creating another malicious actions for bypass.