Malware Sandbox Analysis for Secure Observation of Vulnerability Exploitation

Abstract

SUMMARYExploiting vulnerabilities of remote systems is one of the fundamental behaviors of malware that determines their potential hazards. Understanding what kind of propagation tactics each malware uses is essential in incident response because such information directly links with countermeasures such as writing a signature for IDS. Although recently malware sandbox analysis has been studied intensively, little work is done on securely observing the vulnerability exploitation by malware. In this paper, we propose a novel sandbox analysis method for securely observing malware's vulnerability exploitation in a totally isolated environment. In our sandbox, we prepare two victim hosts. We first execute the sample malware on one of these hosts and then let it attack the other host which is running multiple vulnerable services. As a simple realization of the proposed method, we have implemented a sandbox using Nepenthes, a lowinteraction honeypot, as the second victim. Because Nepenthes can emulate a variety of vulnerable services, we can efficiently observe the propagation of sample malware. In the experiments, among 382 samples whose scan capabilities are confirmed, 381 samples successfully started exploiting vulnerabilities of the second victim. This indicates the certain level of feasibility of the proposed method. key words: malware sandbox analysis, exploit code detection, lowinteraction honeypot

Does Every Second Count? Time-based Evolution of Malware Behavior in Sandboxes

“…In this case, the focus of the work is on the design of the sandbox itself. Examples in this category are papers that describe new network-oriented sandboxes [44], [45], [108], [109] or those describing the use of hypervisor techniques [56]. Overall, we believe that for these papers the short execution time was not critical for the overall contribution.…”

“…Some were explicitly designed to improve or propose new sandbox techniques, while others simply relied on sandboxes to collect data to perform other experiments -such as modeling the behavior of samples, extracting new detection signatures, train a classifier, or report on the internals of certain malware characteristics (such as packing, use of encryption, etc.). [44]- [46], [94], [109] 1 2 [56], [108] 2 14 [21], [26], [35], [40], [43], [52], [70], [85], [91], [95], [100], [101], [105], [110] 3 7 [15], [65]- [67], [71], [81], [93] 4 1 [58] 5 13 [12], [13], [23], [29], [38], [50], [51], [69], [78], [88], [92], [102], [106] 8 2 [20], [89] 10 7 [24], [25], [36], [41], …”

A Malware Obfuscation AI Technique to Evade Antivirus Detection in Counter Forensic Domain

“…However, it attacks with an implemented pre-defined window APIs in the emulator that will return a result inconsequent compared to the executed results outside the emulator [20]. For example, usually opening an unreal URL will return 'true', but it would return an error in multi-processor function, the main purpose behind this work is to highlight the gap between the emulator of the sand box and the APIs implementation of a fully operating system and use these vulnerabilities to evade the detection [21].…”

A Method for Shellcode Extractionfrom Malicious Document Files Using Entropy and Emulation

“…However, the 32-bit Windows executable file output by our system disguises the name of the executable file, as does the application software that would open the document file. Their tool might be able to analyze the 32-bit Windows executable file output by our system, even though we expect that the output executable file would be analyzed via the environment proposed by Inoue and Yoshioka [11]- [13].…”