Upload File

vmray malware analysis sandbox efficacy assessment · there are three main type of attacks where...

  • Home
  • Documents
  • VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour
23
0 VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT

Upload: others

Post on 13-Jun-2020

8 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

0

VMRAYMALWAREANALYSISSANDBOXEFFICACY

ASSESSMENT

Page 2: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

1

ContentsAboutVMRay...........................................................................................................................................2AboutMRGEffitas....................................................................................................................................2AboutUkatemi.........................................................................................................................................2Introduction.............................................................................................................................................3Testdetails...............................................................................................................................................4

High-levelresults..........................................................................................................................................8Detailedresults............................................................................................................................................9

In-thewildtests........................................................................................................................................9Custommalwaretests............................................................................................................................10Anti-antiVM...........................................................................................................................................11Supportedfiletypesandanalysisenvironments...................................................................................14Usefulreports.........................................................................................................................................16Easyinteractionwiththesandboxduringtheanalysis..........................................................................18YARArulesimplemented........................................................................................................................18Strongresistanceagainstpackers..........................................................................................................18Hashbasedreputation,MetadefenderandVirusTotalintegration.......................................................19Maliciousscriptsaredetected...............................................................................................................19SolidbrowserexploitdetectionviaURLanalysis...................................................................................21

Conclusion..................................................................................................................................................22

Page 3: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

2

AboutVMRayVMRayisaCyberSecuritycompanythatprovidesbothacloud-basedandon-premisesproduct,VMRayAnalyzer,fordetectingmalware-relatedthreatsusingdynamicprogramanalysis.

VMRayuseshypervisor-basedmonitoringbuiltontheacademicworkofthetwoco-founders.VMRayAnalyzerisprimarilyusedbyCERTsandSOCsinlargeenterprises,telecomsandtechnologyvendorsforanalyzingandidentifyingmalware,inparticulartargetedattacksrelatedtoAPTs.

AboutMRGEffitasMRGEffitasisaUKbased,independentITsecurityresearchorganisationthatfocusesonprovidingcutting-edgeefficacyassessmentandassuranceservices,thesupplyofmalwaresamplestovendorsandthelatestnewsconcerningnewthreatsandotherinformationinthefieldofITsecurity.

MRGEffitas’origindatesbackto2009whenSvetaMiladinov,anindependentsecurityresearcherandconsultant,formedtheMalwareResearchGroup.ChrisPickardjoinedinJune2009,bringingexpertiseinprocessandmethodologydesign,gainedinthebusinessprocessoutsourcingmarket.

TheMalwareResearchGrouprapidlygainedareputationastheleadingefficacyassessorinthebrowserandonlinebankingspaceand,duetoincreasingdemandforitsservices,wasrestructuredin2011whenitbecameMRGEffitas,withtheparentcompanyEffitas.

Today,MRGEffitashasateamofanalysts,researchersandassociatesacrossEMEA,UATPandChina,ensuringatrulyglobalpresence.

Sinceitsinception,MRGEffitashasfocusedonprovidingground-breakingtestingprocessesandrealisticallymodelingreal-worldenvironmentsinordertogeneratethemostaccurateefficacyassessmentspossible.

MRGEffitasisrecognizedbyseveralleadingsecurityvendorsastheleadingtestingandassessmentorganizationintheonlinebanking,browsersecurityandcloudsecurityspacesandhasbecometheirpartnerofchoice.

Ouranalystshavethefollowingtechnicalcertificates:

OffensiveSecurityCertifiedExpert(OSCE),OffensiveSecurityCertifiedProfessional(OSCP),MalwareAnalysis(DeloitteNL),CertifiedInformationSystemsSecurityProfessional(CISSP),SecurityTubeLinuxAssemblyExpert,SecurityTubePythonScriptingExpert,CertifiedPenetrationTestingSpecialist(CPTS),ComputerHackingForensicsInvestigator(CHFI),andMicrosoftCertifiedProfessional(MCP).

AboutUkatemiUkatemiTechnologiesisaspin-offfromtheCrySySLab,Budapest.ItwasfoundedinDecember2012bymembersofCrySySLabwiththemissiontoaddressproblemsoftargetedattacksincyberspace.Targetedattacksoftenuseadvancedmethods,aimtocompromisehighprofiletargets,arestealthyandpersistent,and,therefore,difficulttodetectandmitigate.Ukatemifocusesonprovidingtoitsclientscustomizedthreatintelligencereportsandincidenthandlingservices,includingmalwareanalysis.Ukatemiprovidespersonalizedservicesthatmaynotbeprocuredelsewhere.

Page 4: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

3

IntroductionVMRaycommissionedMRGEffitastoconductanefficacyanalysisofitsVMRaymalwareanalysissandboxproduct.Thissandboxiscapableofdetectingtraditionalmalware,malwaresimulatingAPTattackers,documentscontainingexploits,exploitsonURLs,andothermaliciousactivities.

ThetermAdvancedPersistentThreat(APT)referstoapotentialattackerthathasthecapabilityandtheintenttocarryoutadvancedattacksagainstspecifichigh-profiletargetsinordertocompromisetheirsystemsandmaintainpermanentcontrolovertheminastealthymanner.APTattacksoftenrelyonnewmalware,whichisnotyetknowntoandrecognizedbytraditionalanti-virusproducts.APTattackerstypicallyusespearphishingorwateringholetechniquestodeliverthemalwaretovictimcomputerswhereitisinstalledbyenticingtheusertoopenthefilecontainingthemalwareorthelinkpointingtoit.Installationofthemalwaremayalsoinvolveexploitingsomeknownorpubliclyunknownvulnerabilityinthevictimsystem,orsocialengineering.Oncethemalwareisinstalled,itmayconnecttoaremoteCommand&Controlserver,fromwhichitcandownloadupdatesandadditionalmodulestoextenditsfunctionality.Inaddition,themalwaremayuserootkittechniquesinordertoremainhiddenandtoprovidepermanentremoteaccesstothevictimsystemfortheattackers.

Astraditionalanti-virusproductsseemtoberatherineffectiveindetectingnewmalware,andhence,mitigatingAPTattacks,arangeofnewsolutions,specificallydesignedtodetectAPTattacks,haveappearedonthemarketintherecentpast.Theseanti-APTtoolsopenthosefilesinasandboxenvironmentonvirtualmachinesundervariousconfigurationsettings,analyzethebehaviourproducedbythevirtualmachines,andtrytoidentifyanomaliesthatmayindicatethepresenceofamalwareoranexploitationattempt.

Thereisnodoubtthatthesenewtoolsareuseful.However,determiningtherealeffectivenessofthesetoolsischallenging,becausemeasuringtheirdetectionratewouldrequiretestingthemwithnew,previouslyunseenmalwaresampleswithcharacteristicssimilartothoseofadvancedmalwareusedbyAPTattackers.Developingsuchtestsamplesrequiresspecialexpertiseandexperienceobtainedeitherthroughthedevelopmentofadvancedtargetedmalwareoratleastthroughextensiveanalysisofknownsamples.

WeatMRGEffitasandUkatemidecidedtojoinforcesandperformatestofleadingAPTattackdetectiontoolsusingcustomdevelopedsamples.MRGEffitashasextensiveexperienceintestinganti-virusproducts,whileUkatemihasaverygoodunderstandingofAPTattacksgainedthroughtheanalysisofmanytargetedmalwarecampaigns(includingDuqu,Flame,MiniDukeandTeamSpy).Therefore,collaboratingandbringingtogetherourcomplementarysetsofexpertiselookedlikeapromisingidea.

Page 5: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

4

TestdetailsThefollowingcomponentsandtestcaseswereusedduringthetest:

• Numberofin-the-wildexploits:10• Numberofin-the-wildmalware:60• Numberoffullcustommalware:2• Numberofdifferentcustomexploitobfuscation(Java,Flash):1• Numberofdifferentsandboxevasiontechniques:10• Publiclyknown,butcustomizablemalwaresamples:15• Numberofstandardoff-the-shelveexploitkit(e.g.Metasploit)testcases:10• Sampleswithcustomcrypters:1• Sampleswithknowncrypters:2• Numberofdifferentdeliverymethods(exploit,macro,javaself-signed,ActiveX,HTML5,etc):4• Totalnumberoftestcases:~95

ThetargetplatformwasWindows764-bit,withInternetExplorer11andrecentversionsofFirefox,Chrome,AdobeFlashPlayer,AdobeAcrobat,MicrosoftOffice,SilverlightandJavaRuntimeEnvironment.

WetestedbrowserexploitsthattargetInternetExplorerandFlashasthesearethemostprevalentattacksatpresent.BesidestheseexploitsweusedPDF,RTF,andDOCXtypeexploits.Non-prevalentfile-typeslikeAVIandCHMwereoutofscope.

AfterafirstroundoftestssomeissueswereidentifiedintheVMRayanalysisenvironment.MRGEffitasprovidedfeedbacktotheVMRayteamonsuggestedadjustmentstoaddresstheseissues.Thisreportcontainstheresultoftheretestaftersomeoftheseissueswereaddressed.

Ourtestsincludedthefollowingparametersandcustomdevelopedtools:

• Weusedencodedshellcodestoavoiddetection• WeusedPowerShell,VisualBasicScriptandBatch-basedattackstosimulateAPT

attackers• WedevelopedMicrosoftOfficefileswithdirectshellcodeexecution(noPEisdroppedto

thehard-disk)

Page 6: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

5

• WeusedknownpackerslikeThemidaandVMProtectandalsodevelopedtwonewcustompackers(XOR,Compress+XOR)

• WeusedknownRATslikePoisonIvyandNJRat

Page 7: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

6

• WetestedshellcodeexecutionembeddedintoPython,RubyscriptsorGobinaries• WedevelopedsampleswithMD5-basedhashcollisions• WeusedexploitstargetingFlash,Java,AdobeReader,MicrosoftOfficeandSilverlight• Weusedencodedpayloaddeliveryduringexploits• Weusedlateralmovementinatest,andasafirststep,weextractedhashesfromthe

machinewhichcanbeusedinpass-the-hashattacks• Wedevelopedcustomexploitencryptionmethodswhereapassivenetworklistener

devicecannotreplaytheexploit,becauseitlackstheencryptionkeys• Wedeveloped10newmalwareanalysissandboxdetectiontechniques

Page 8: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

7

• WesignedsomemalwaresampleswithbothvalidandinvalidcertificatestosimulateAPTattackers

• Themajorityofthein-the-wildmalwareandexploitkittestsweredonelive• Weusedthefollowingexploit-kitsinourexploitkittests:Rig,Sundown,Metasploit

Page 9: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

8

High-levelresultsAfterperformingthetests,weidentifiedthefollowingstrengthsoftheVMRaymalwareanalysissandbox:

• Thesandboxisverystrongathidingboththevirtualizationlevelfrommalwarerunninginthesandbox(anti-anti-vm)andanyspecificartefactsofthesandboxitself.

• Thenumberofsupportedanalysisenvironmentsandfiletypesareaboveindustryaverage.• Thereportsareusefulforbothbeginnersandadvancedusers.• Itiseasytointeractwiththeanalysisenvironmentduringanalysisincasemanualactionsare

neededtotriggerthemaliciousactivity.• Theanalysisenvironmentisconfigurablewithprescripts,whichprovidesoptionsforadvanced

userstofine-tunetheanalysisenvironment.• TheYARArulesareeffectivetodetectknownbutpackedmalwarebyinspectingthememory

whenthecodeisunpacked.• TheYARArulesareeffectivetodetectknownexploitslikeOfficefiles,PDF• Thesandboxwillanalyzemalwarethatispacked–packersarethebiggestenemiesoftraditional

antivirusengines.• Thesandboxhashash-basedreputationcheckingandMetadefenderintegration• Besidesexecutables,maliciousscriptswritteninPowerShellarealsodetected• ThesandboxhassolidexploitdetectionviaURLanalysis• TheRESTAPIinterfaceiswelldocumented

Page 10: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

9

DetailedresultsIn-thewildtestsFollowingarethemalwareanalysissandboxresultsofthein-the-wildmalwaresamples.VTIscoresaretheresultsofthedynamicexecutionofthemalwareinsidethesandbox.

In-the-wild-malware TestResults

%ofsamplesdetectedasMalicious* 88%%ofsamplesdetectedasBlacklisted* 12%

TotalDetectionEfficacy 100%

*VMRaySeverityScoreChart

Blacklisted VMRay’sreputationenginerecognizesthesampleasaknownmaliciousfile

Malicious VMRay’sdynamicanalysisenginedeterminesthatthefileismaliciousbasedonspecificbehaviorpatterns

Suspicious VMRay’sdynamicanalysisenginedeterminesthatthefileissuspiciousbasedonspecificbehaviorpatterns

NotSuspicious VMRay’sdynamicanalysisenginedeterminesthatthefileisnotsuspiciousbasedonbehaviorpatterns

Whitelisted VMRay’sreputationenginerecognizesthesampleasaknownbenignfile

Figure1-FinaldetectionviaVTIandreputationforin-the-wildmalware

12%

88%

Finalin-the-wildsampledetection

blacklisted

malicious

Page 11: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

10

CustommalwaretestsVMRayAnalyzerdetectedthemajorityofcustommalwaresamplesasmalicious,therebyhighlightingitsabilitytodetecthighlyevasiveandadvancedmalware.Insomecustommalwaretestscenarios,VMRay’sdynamicanalysisenginedeterminedthatthefilewassuspicious(butnotmalicious)basedonspecificbehaviorpatterns.ThereareseveralreasonswhyVMRay’sdynamicanalysisenginemayonlyclassifyafileassuspiciousandnotmalicious.Forexample,ifthecommandandcontrolserverisinactiveatthetimeoftheanalysis,thesamplemaybedeemedtobelessmaliciousthanitactuallyis.Similarly,iftheC&Cisavailable,butnomaliciousactionsarereceivedfromthecommandandcontrolserverduringtheanalysis,thesamplemayonlybeclassifiedassuspicious.PleasenotethatthisisageneralshortcomingofdynamicmalwareanalysisandisnotspecifictoVMRayAnalyzer.

Page 12: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

11

Anti-antiVMFinding

Therearethreemaintypeofattackswhereattackerscandetectthemalwareanalysissandbox,andchangethemalwarebehaviourifananalysisenvironmentisdetected:

1.Detectionofvirtualizationsoftware(Virtualbox,VMWare,QEMU,KVM…)

2.Identifyadifferencebetweenthetargetcomputer(e.g.desktopcomputerwithuseractivity)andaplainanalysisenvironments.

3.Context–awareorenvironment-awaremalware,wherethemalwaresampleonlytriggersifspecificfactorsaremet,e.g.itstartsonagivendateonly,oritchecksthepresenceofaspecificenvironmentvariable,registrykey,etc.Itisevenpossibletoencryptthemalwarepayloadbasedonthevalueofthisvariable,sowithoutknowing(orguessing)thecorrectvalue,thepayloadcannotbedecrypted.

VMRayhasaseriesofblogpostsonsandboxevasiontechniqueshere:https://www.vmray.com/blog/sandbox-evasion-techniques-part-1/

Whenitcomestodetectionofvirtualizationsoftware,thede-factostandardisthePafishtool:https://github.com/a0rtega/pafish

VMRayisimplementedasamodifiedKVM/QEMU,sowecanonlyexpectVMdetectionsontheKVM/QEMUpart.ByrunningthePafishtool,wecanseethatthereisnotasingledetectionofthevirtualizationenvironment.Note:sometimes,PafishdetectsthatVMRaydoesnotsimulatemousemovement,butthisisabuginPafish(thewindowtocheckistooshort),andnotinVMRay.

Page 13: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

12

Page 14: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

13

Whenitcomestodetectingthedifferencebetweenthetargetcomputerandtheanalysisenvironment,thefollowingresearchisuseful:

https://github.com/MRGEffitas/Sandbox_tester

https://www.youtube.com/watch?v=-wN5XvrfuxY

Byrunningthetool,wecanbesurethattheVMRayenvironmentfakesthefollowinginordertobeundetectableformalwarewhichtargetsthedesktopenvironment:

• Thereareiconsandfilesonthedesktop• Therearestandardapplicationsinstalled• ThereareapplicationswithGUIrunninginthebackground• Therearenon-defaultbookmarksinInternetExplorer• Thereisaprinterattachedtothesystem• Allthehardwaredescriptorsmatchadesktopsystem• Thegettickcountandlastbootuptimeshowsthatthesystemisalreadyupandrunningfora

while• Thescreenresolutionmatchesadesktopresolution• Thesysteminteractswithmessageboxes(atrickcommonlyusedinRATsamples)• Thesleepdetectionofthescriptcan’tdetectthepresenceofsleephooking,butinreality,

sleepsarefast-forwarded.

Page 15: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

14

• Non-defaultdesktopbackgroundisused

Todefeatcontext-awaremalware(almostexclusivelyusedinAPTattacks),onehastoknowwhatconfiguration/environmentisexpectedbythemalware.Whenthisisknown,eithertheprescriptsortheinteractionwiththeVMduringtheanalysiscanbeusedtotriggerthemaliciouspayloadbythemalware.Alternatively,whenrunon-prematacustomersite,VMRaycanusethecustomer’sowngoldimagesastargetmachinesforanalysis.

SupportedfiletypesandanalysisenvironmentsFinding

Thesupportedfiletypesandanalysisenvironments(withOS,programversionsandpatchlevels)makeitusefultoanalyseanyin-the-wildthreat.

Page 16: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

15

Page 17: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

16

UsefulreportsFinding

Thereportsgeneratedbythesystemareusefulforbothbeginnersandadvancedusers.

Page 18: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

17

Page 19: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

18

EasyinteractionwiththesandboxduringtheanalysisFinding

Itisnotuncommonthatthesamplewon’tstartwithoutanyspecificuseractivity.E.g.somesamplesuse

aninstaller,whereauserhastoclickthroughaseriesofwindowsbeforethemaliciouspayloadis

delivered.TheVMRaymalwareanalysissandboxenvironmenthasautomatedusersimulation,providing

themouseandkeyboardinputthemalwarewouldtypicallyexpect.Italsomakesiteasytomanually

interactwiththeenvironmentduringanalysis,byonlyusingthewebbrowserandHTML5technology.

Fortaskswhichcanbeautomated,prescriptscanbewrittenanduploadedtotheanalysisenvironment.

Thesescriptscanchangetheanalysisenvironmentforthespecifiedmalware.EXE,BatchFile,Windows

scriptinghostfileetc.canbeusedforaprescript.

YARArulesimplementedFinding

YARA“providesarule-basedapproachtocreatedescriptionsofmalwarefamiliesbasedontextualor

binarypatterns.”Itisagreattooltoclassifyknownmalware,andalsotoidentifynewsamplesfor

knownmalwarefamilies.YARAisespeciallyeffectivewhenthesampleispacked,buttheruleisusedon

theunpacked,in-memoryprocess.YARAcanalsobeusedtodetectdocumentfiles(Word,Excel,PDF)

containingexploits.

VMRayincorporatesYARArulestodetectthevariantsfromknownfamilies,andtodetectnewsamples

ofknownexploits.Theyareappliedtovariousanalysisartifacts(extractedfiles,processdumps,network

dumps,etc.).

StrongresistanceagainstpackersFinding

Traditionalendpointprotectioncanbebypassedbypackerswithrelativeease.Bypackingafile,the

behaviourofthemalwareiskept,butthestructureoftheoriginalmalwareislost,thusblacklistslike

signaturebaseddetectionscanbebypassedeasily.Malwareanalysissandboxesweredevelopedto

Page 20: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

19

inspectthebehaviourofthesamples.Soanymalwareanalysissandboxshouldhavegoodresistance

againstpackers–andsodoesVMRay.Alotofpackersintegratedanti-sandboxsolutions,whichmakes

theanalysisinasandboxhard.Thisiswhyanti-anti-sandboxsolutionsimplementedintoVMRayare

important.

Hashbasedreputation,MetadefenderandVirusTotalintegrationFinding

Samplehashescanbesenttoexternalreputationengines,andifthesampleisalreadyknown,theresult

ofthereputationcheckcanbeincludedinthereport.

Incasethesampleisnotknowntothereputationenginebythehash,butisknowntooneormoreAV

engines,MetadefendercanbeintegratedintoVMRay,andthedetectioncanbeimprovedwiththe

knowledge-baseofthemultipleAVscannersrunninginMetadefender.Iftheconfidentialityofthefiles

arenotimportant,thefilescanbedirectlyuploadedtoVirusTotal.

MaliciousscriptsaredetectedFinding

SomemalwareanalysissandboxesfocusmostlyonEXEfiles.Butattackersuseavarietyoffilesand

techniques.OneofthemostrecenttargetedattacksemployedPowerShell.VMRaycandetect

obfuscatedormaliciousPowerShellattacks–andnotjustbycheckingthebehaviourofthemalware

processes,butbycheckingforknowntechniquesusedinPowerShellattacks–e.g.useofencoded

PowerShellattacks.

Page 21: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

20

Page 22: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

21

SolidbrowserexploitdetectionviaURLanalysisFinding

TheURLanalysismodulewasabletodetectin-the-wildexploitkitslikeRIGorSundownonliveURLs.

TheexploitkitstargetedvulnerabilitiesinInternetExplorerandinFlash.

Page 23: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

22

ConclusionWefoundtheVMRaymalwareanalysissandboxtobeanexcellenttooltodetectmalicioussoftware,

documentscontainingexploitsormaliciousURLs.Thedevelopersofthesystemclearlyunderstandthe

threatlandscape,anddevelopedthesystemaccordingly.Itishighlyrecommendedfordigitalforensics

andincidentresponse(DFIR)professionalsandaspartofasuiteoftoolsforCERTs.


Cuckoo Sandbox: Automated malware analysis

Hack&Beers Cadiz Análisis de Malware Cuckoo Sandbox

Think Outside the Sandbox Cisco AMP (Advanced Malware ... · PDF fileCisco AMP (Advanced Malware Protection) ... Think Outside the Sandbox Cisco AMP (Advanced Malware Protection)

FireEye Wins Global Advanced Malware Sandbox … Global Advanced Malware Sandbox Market ... security solutions that guide customers from ... the 2016 Advanced Malware Sandbox Market

Deep Malware Analysis - Joe Sandbox Sandbox Cloud Feature... · Sandbox Cloud Deep Malware Analysis Classification Ransomware Spreading Phishing Banker Adware Trojan / Bot Spyware

VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · 2020-02-20 · 2 About VMRay VMRay is a CyberSecurity company that provides both a cloud-based and on-premises product, VMRay

Frost & Sullivan Advanced Malware Sandbox Market Analysis

Advanced malware analysis training session6 malware sandbox analysis

2016 Global Advanced Malware Sandbox Market Leadership Award

Defeating Evasive Malware (VMRay Whitepaper) - Malware … · 2020-03-10 · the presence of a virtual machine or hypervisor. • Evasion by using time, event or environment based

Malware Analysis Workshop June 5, 2012 - CCDCOE · Malware Analysis Workshop June 5, 2012 ... •Malware Analysis methods ... •Some malware doesnt run in Norman Sandbox

Inside the Matrix,How to Build Transparent Sandbox for Malware Analysis

Introduction to malware analysis with Cuckoo Sandbox

Detecting Evasive Malware in Sandbox

Deep Malware Analysis - Joe Sandbox Sandbox Desktop Feature... · Sample: b19411d.js Startdate: 29/03/2016 Architecture: WINDOWS Score: 100 ... Sandbox Desktop Deep Malware Analysis

Webinar: Stopping evasive malware - how a cloud sandbox array works

Norman SandBox Analyzerdownload01.norman.no/product_sheets/eng/SandBox_analyzer.pdf · Norman SandBox Analyzer Analyzing malware can be a cumbersome and time consuming ... internet

Automated Malware Analysis Report for ... - Joe Sandbox

Sandbox: Análisis dinámico de malware - UNAM- · PDF fileSandbox para el análisis dinámico de malware Implementado en Cuckoo sandbox Análisis del tráfico de red Archivos que

Advanced Malware Sandbox Market Analysis - FireEye · K083-74 1 K083-74 September 2016 Advanced Malware Sandbox Market Analysis “Must Have” Security Technology Reaches Mass Adoption

COUNTERING INNOVATIVE SANDBOX EVASION TECHNIQUES USED … · COUNTERING INNOVATIVE SANDBOX EVASION TECHNIQUES USED BY MALWARE ... •State of the Art malware analysis systems use

FireEye Wins Global Advanced Malware Sandbox Market

ICS MALWARE SANDBOX HIGHLIGHTS - CyberX · Sandbox can rapidly and automatically identify ICS-specific malware, pinpoint its IOCs, and enable threat intelligence sharing ... security

Duping the machine: malware strategies, post Sandbox detection · Duping the machine: malware strategies, post Sandbox detection VB2014. 2 ... ￮IP address of Sandbox machine appears

Deep Malware Analysis - Joe Sandbox Sandbox Ultimate Feature... · Sample: b19411d.js Startdate: ... Deep Malware Analysis, ... Joe Sandbox Mail Monitor Malware similarity analysis

NSC-JST workshop · Fighting Malware & Botnets – Introduction ... Automated dynamic malware Behavior Analysis ... summary based on Cuckoo Sandbox

Detectionofdebuggeraware malware - Aalborg Universitetprojekter.aau.dk/projekter/files/213622016/master.pdf · Detectionofdebuggeraware malware Project Report ... and a Cuckoo Sandbox

STEALTH SANDBOX ANALYSIS OF MALWARE

Covering the global threat landscape - Virus Bulletin · end-to-end analysis of malware. INTRODUCTION ... FAME is not a malware analysis sandbox, ... support for both Cuckoo Sandbox

Cuckoo Sandbox - University of Delawarecavazos/cisc850-spring2017/...CISC 850 : Cyber Analytics Cuckoo Sandbox • Automated malware analysis system. • Uses virtualization and supports

STEALTH SANDBOX ANALYSIS OF MALWARE · ABSTRACT STEALTH SANDBOX ANALYSIS OF MALWARE Omer Sezgin U˘gurlu¨ M.S. in Computer Engineering Supervisor: Assist. Prof. Dr. Ali Aydin Selc¸uk

Behavioural Analysis of Malware Using Custom Sandbox … · 2020. 1. 25. · Cuckoo Sandbox and the Virtual Machine (VM) manager called VirtualBox, a systematic way of testing malware

Malware Analysis without Sandbox - ETDA · July 4, 2017 MCAFEE CONFIDENTIAL 1 McAfee CONFIDENTIAL Malware Analysis without Sandbox Nishant Ranjan | Regional Solutions Architect -

VMRAY MALWARE ANALYSIS SANDBOX …€¦ · 3 Introduction VMRay commissioned MRG Effitas to conduct an efficacy analysis of its VMRay malware analysis sandbox product. This sandbox

Advanced Malware Analysis Training Session 6 - Malware Sandbox Analysis