https://bit.ly/40lOVMh - Tailoring Sandbox Techniques to Hidden Threats In the article "Tailoring Sandbox Techniques to Hidden Threats," the authors discuss the challenges faced by automated detection systems in addressing evasive malware techniques. They present two notable adaptations to their analysis platform, Advanced WildFire, to improve detection: dependency emulation and stealthy instrumentation through VMI SSL/TLS decryption. Dependency emulation addresses the issue of malware requiring external dependencies to execute. By automatically detecting and adapting the sandbox environment to the files being detonated, this approach prevents unintentional crashes or bugs in the analyzed samples, enabling better detection. An example of dependency emulation is provided through the examination of the Sality malware family, which requires specific libraries to run inside a sandbox. VMI SSL/TLS decryption focuses on intercepting and decrypting malware communications made over HTTPS and other SSL-based protocols. By reverse engineering the ncrypt.dll library in recent versions of the Windows OS, the authors can extract master keys and decrypt SSL communications, as illustrated through a Delphi-based loader example.
