Investigating Anti-Evasion Malware Triggers Using Automated Sandbox Reconfiguration Techniques

Abstract

Malware analysis is fundamental for defending against prevalent cyber security threats and requires a means to deploy and study behavioural software traits as more sophisticated malware is developed. Traditionally, virtual machines are used to provide an environment that is isolated from production systems so as to not cause any adverse impact on existing infrastructure. Malware developers are fully aware of this and so will often develop evasion techniques to avoid detection within sandbox environments. In this paper, we conduct an investigation of anti-evasion malware triggers for uncovering malware that may attempt to conceal itself when deployed in a traditional sandbox environment. To facilitate our investigation, we developed a tool called MORRIGU that couples together both automated and human-driven analysis for systematic testing of anti-evasion methods using dynamic sandbox reconfiguration techniques. This is further supported by visualisation methods for performing comparative analysis of system activity when malware is deployed under different sandbox configurations. Our study reveals a variety of anti-evasion traits that are shared amongst different malware families, such as sandbox “wear-and-tear”, and Reverse Turing Tests (RTT), as well as more sophisticated malware samples that require multiple anti-evasion checks to be deployed. We also perform a comparative study using Cuckoo sandbox to demonstrate the limitations of adopting only automated analysis tools, to justify the exploratory analysis provided by MORRIGU. By adopting a clearer systematic process for uncovering anti-evasion malware triggers, as supported by tools like MORRIGU, this study helps to further the research of evasive malware analysis so that we can better defend against such future attacks.

Detection of DGA-based Malware Communications from DoH Traffic Using Machine Learning Analysis

“…The evaluation confirmed that parameter-tuned LightGBM in the 3rd stage detected DoH traffic generated by Pad-Crypt [22], Sisron [23], Tinba [24], [25], and Zloader [26] with 99.12% accuracy. In addition, parameter-tuned LightGBM in the 1st stage filtered DoH traffic with 99.92% accuracy, and parameter-tuned CatBoost in the 2nd stage recognized suspi- cious DoH traffic with 99.97% accuracy.…”

Investigating Malware Propagation and Behaviour Using System and Network Pixel-Based Visualisation

“…One challenge in any sandbox monitoring agent is whether the agent itself is compromised or interferes with the malware execution. Many malware samples look for environment parameters that may suggest they are running in a sandbox [19], such as the present of agent.py which is used by Cuckoo or the phrase "VMware" occurring in the Windows registry. We found that our various data collectors would terminate at different times, which is likely related to this.…”

A Kullback-Liebler divergence-based representation algorithm for malware detection

“…Moreover, mimicking legitimate behavior is a widely used strategy by todays malware ( Bulazel & Yener, 2017 ; Alaeiyan, Parsa & Conti, 2019 ; Or-Meir et al, 2019 ; Afianian, Niksefat & Sadeghiyan, 2019 ; Mills & Legg, 2020 ; Amer, El-Sappagh & Hu, 2020 ). In addition, evasion behaviors have been observed in both benign and malicious classes ( Galloro et al, 2022 ).…”

“…By analyzing 45,375 malware samples, Galloro et al (2022) concluded that the use of evasion mechanisms has increased among malware by 12% over the past ten years, and 88% of malicious software can perform new evasion behaviors rather than the older ones. Evasive malware instances either imitate legitimate behaviors or violently interrupt the execution in sandboxed execution conditions ( Bulazel & Yener, 2017 ; Alaeiyan, Parsa & Conti, 2019 ; Or-Meir et al, 2019 ; Afianian, Niksefat & Sadeghiyan, 2019 ; Mills & Legg, 2020 ). Additionally, Galloro et al (2022) in their work, reported that evasion behaviors have picked up in both malware and benign instances because those evasion techniques have been originally developed for a legitimate purpose, such as to prevent reversing, and protect intellectual property.…”