Duping the machine: malware strategies, post sandbox detection (slides)

MrBrian · Oct 2, 2014

From https://www.virusbtn.com/conference/vb2014/abstracts/Wyke.xml:

In this paper we explore the different strategies malware employ once a sandbox has been detected. We present examples of decoy behaviour that ranges from dummy files dropped to fixed path names, bogus DNS and HTTP requests, and misleading configuration files being delivered. We examine samples of the main protagonist malware families including Andromeda, Shylock, Simda and Vundo.

We classify the techniques involved and assess the motivation for each approach by asking what the benefit to the malware author is in each case.
Click to expand...

Here is one of the techniques:

Blacklisting: Artifacts such as IP address are identified as potentially belonging to researchers, normal execution will not take place from these addresses even if other checks pass.
Click to expand...

Log in or Sign up

Duping the machine: malware strategies, post sandbox detection (slides)

MrBrian Registered Member

Log in or Sign up

Duping the machine: malware strategies, post sandbox detection (slides)

MrBrian Registered Member

Useful Searches