Nymaim - evading Sandboxes with API hammering

[echo1]

Content source

http://joe4security.blogspot.ch/2016/04/nymaim-evading-sandboxes-with-api.html

Evading Sandboxes with API hammering

 

[hjlbx]

The article applies to sandboxes like Cuckoo Sandbox that analyzes the run sequence, APIs, etc; the article does not apply to security softs like Sandboxie or Shadow Defender.

So don't get all bent out of shape...

 

[LabZero]

The problem is that most of the malware runs in user mode (as normal or administrator user). Sandbox based on virtualization, running the Windows API calls and system calls in user mode. System calls or function capturing the interactions between a program and its environment (for example, when files are read, registry keys are written and generates network traffic). But generally, the sandbox can not locate everything that happens between the system calls so some malware can go in this out - of - control zone substantially by evading the sandbox.