SandPrint: Fingerprinting Malware Sandboxes to Provide Intelligence for Sandbox Evasion

  • Akira Yokoyama
  • Kou Ishii
  • Rui Tanabe
  • Yinmin Papa
  • Katsunari Yoshioka
  • Tsutomu Matsumoto
  • Takahiro Kasama
  • Daisuke Inoue
  • Michael Brengel
  • Michael Backes
  • Christian Rossow
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9854)

Abstract

To cope with the ever-increasing volume of malware samples, automated program analysis techniques are inevitable. Malware sandboxes in particular have become the de facto standard to extract a program’s behavior. However, the strong need to automate program analysis also bears the risk that anyone that can submit programs to learn and leak the characteristics of a particular sandbox.

We introduce SandPrint, a program that measures and leaks characteristics of Windows-targeted sandboxes. We submit our tool to 20 malware analysis services and collect 2666 analysis reports that cluster to 76 sandboxes. We then systemically assess whether an attacker can possibly find a subset of characteristics that are inherent to all sandboxes, and not just characteristic of a single sandbox. In fact, using supervised learning techniques, we show that adversaries can automatically generate a classifier that can reliably tell a sandbox and a real system apart. Finally, we show that we can use similar techniques to stealthily detect commercial malware security appliances of three popular vendors.

References

  1. 1.
    Amnpardaz Sandbox - File Analyzer. http://jevereg.amnpardaz.com/
  2. 2.
    Anubis: Malware Analysis for Unknown Binaries. https://anubis.iseclab.org/
  3. 3.
    Bkav - Scan virus online. http://quetvirus.vn/default.aspx?lang=en
  4. 4.
    bochs: The Open Source IA-32 Emulation Project. http://bochs.sourceforge.net
  5. 5.
    Dr. Web Online Check. http://online.drweb.com/?lng=en
  6. 6.
    FortiGuard Center. Online Virus Scanner. http://www.fortiguard.com/virusscanner
  7. 7.
    Gary‘s Hood. Online Virus Scanner. http://www.garyshood.com/virus/
  8. 8.
    Malwr - Malware Analysis by Cuckoo Sandbox. https://malwr.com/
  9. 9.
    NVMTrace: Proof-of-concept Automated Baremetal Malware Analysis Framework. https://code.google.com/p/nvmtrace/
  10. 10.
    Oracle VM VirtualBox. https://www.virtualbox.org
  11. 11.
  12. 12.
  13. 13.
  14. 14.
    VirusTotal - Free Online Virus, Malware and URL Scanner. https://www.virustotal.com/en/
  15. 15.
  16. 16.
    Bayer, U., Milani Comparetti, P., Hlauschek, C., Kruegel, C., Kirda, E.: Scalable, behavior-based malware clustering. In: Network and Distributed System Security Symposium (NDSS) (2009)Google Scholar
  17. 17.
    Bellard, F.: QEMU, a fast and portable dynamic translator. In: Proceedings of the Annual Conference on USENIX Annual Technical Conference, ATEC 2005 (2005)Google Scholar
  18. 18.
    Brengel, M., Backes, M., Rossow, C.: Detecting hardware-assisted virtualization. In: Caballero, J., Zurutuza, U., Rodríguez, R.J. (eds.) DIMVA 2016. LNCS, vol. 9721, pp. 207–227. Springer, Heidelberg (2016). doi:10.1007/978-3-319-40667-1_11 CrossRefGoogle Scholar
  19. 19.
    Caballero, J., Grier, C., Kreibich, C., Paxson, V.: Measuring pay-per-install: the commoditization of malware distribution. In: USENIX Security (2011)Google Scholar
  20. 20.
    Comodo. Comodo Instant Malware Analysis. http://camas.comodo.com/
  21. 21.
    Cristianini, N., Shawe-Taylor, J.: An Introduction to Support Vector Machines and Other Kernel-based Learning Methods. Cambridge University Press, Cambridge (2000)CrossRefMATHGoogle Scholar
  22. 22.
    DEXLabs. Detecting Android Sandboxes (2012). http://www.dexlabs.org/blog/btdetect
  23. 23.
    Dinaburg, A., Royal, P., Sharif, M., Ether, L.W.: Malware analysis via hardware virtualization extensions. In: Proceedings of the 15th ACM Conference on Computer and Communications Security, CCS 2008 (2008)Google Scholar
  24. 24.
    Egele, M., Scholte, T., Kirda, E., Kruegel, C.: A survey on automated dynamic malware-analysis techniques and tools. ACM Comput. Surv. 44, 2 (2008)Google Scholar
  25. 25.
    F-Secure. Sample Analysis System. https://analysis.f-secure.com/portal/login.html
  26. 26.
    Freiling, F.C., Holz, T., Wicherski, G.: Botnet tracking: exploring a root-cause methodology to prevent distributed denial-of-service attacks. In: di Vimercati, S.C., Syverson, P.F., Gollmann, D. (eds.) ESORICS 2005. LNCS, vol. 3679, pp. 319–335. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  27. 27.
    Jing, Y., Zhao, Z., Ahn, G.-J., Hu, H.: Morpheus: automatically generating heuristics to detect android emulators. In: Proceedings of the 30th Annual Computer Security Applications Conference, ACSAC 2014 (2014)Google Scholar
  28. 28.
    Jotti. Jotti’s Malware Scan. http://virusscan.jotti.org/en
  29. 29.
  30. 30.
    Kirat, D., Vigna, G., Kruegel, C.: Barecloud: bare-metal analysis-based evasive malware detection. In: Proceedings of the 23rd USENIX Conference on Security Symposium, SEC 2014 (2014)Google Scholar
  31. 31.
    Kirati, D., Vigna, G., Kruegel, C.: BareBox: efficient malware analysis on bare-metal. In: Proceedings of the 27th Annual Computer Security Applications Conference, ACSAC 2011 (2011)Google Scholar
  32. 32.
    Lanzi, A., Balzarotti, D., Kruegel, C., Christodorescu, M., Kirda, E.: AccessMiner: using system-centric models for malware protection. In: Proceedings of the 17th ACM Conference on Computer and Communications Security, CCS 2010 (2010)Google Scholar
  33. 33.
    Maier, D., Müller, T., Protsenko, M.: Divide-and-Conquer: why android malware cannot be stopped. In: Proceedings of the 2014 Ninth International Conference on Availability, Reliability and Security, ARES 2014 (2014)Google Scholar
  34. 34.
    Martignoni, L., Paleari, R., Roglia, G.F., Bruschi, D.: Testing CPU emulators. In: Proceedings of the Eighteenth International Symposium on Software Testing and Analysis, ISSTA 2009 (2009)Google Scholar
  35. 35.
    Microsoft. Submit a sample - Microsoft Malware Protection Center. https://www.microsoft.com/security/portal/submission/submit.aspx
  36. 36.
    Neugschwandtner, M., Comparetti, P. M., Platzer, C.: Detecting malware’s failover C&C strategies with squeeze. In: Proceedings of the 27th Annual Computer Security Applications Conference, ACSAC 2011 (2011)Google Scholar
  37. 37.
    Neuner, S., van der Veen, V., Lindorfer, M., Huber, M., Merzdovnik, G., Mulazzani, M., Weippl, E.: Enter Sandbox: Android Sandbox Comparison (2015). http://arxiv.org/ftp/arxiv/papers/1410/1410.7749.pdf
  38. 38.
    OPSWAT. Metascan Online: Free File Scanning with Multiple Antivirus Engines. https://www.metascan-online.com/#!/scan-file
  39. 39.
    Pa, Y.M.P., Suzuki, S., Yoshioka, K., Matsumoto, T., Kasama, T., Rossow, C.: IoTPOT: analysing the rise of IoT compromises. In: Proceedings of the 9th USENIX Workshop on Offensive Technologies, WOOT (2015)Google Scholar
  40. 40.
    Paleari, R., Martignoni, L., Roglia, G.F., Bruschi, D.A.: Fistful of red-pills: how to automatically generate procedures to detect CPU emulators. In: Proceedings of the 3rd USENIX Conference on Offensive Technologies, WOOT 2009 (2009)Google Scholar
  41. 41.
    Pék, G., Bencsáth, B., Buttyán, L.: nEther: in-guest detection of out-of-the-guest malware analyzers. In: Proceedings of the Fourth European Workshop on System Security, EUROSEC 2011 (2011)Google Scholar
  42. 42.
    Petsas, T., Voyatzis, G., Athanasopoulos, E., Polychronakis, M., Ioannidis, S.: Rage against the virtual machine: hindering dynamic analysis of android malware. In: Proceedings of the Seventh European Workshop on System Security, EuroSec 2014 (2014)Google Scholar
  43. 43.
    Raffetseder, T., Kruegel, C., Kirda, E.: Detecting system emulators. In: Garay, J.A., Lenstra, A.K., Mambo, M., Peralta, R. (eds.) ISC 2007. LNCS, vol. 4779, pp. 1–18. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  44. 44.
    Rieck, K., Schwenk, G., Limmer, T., Holz, T., Laskov, P.: Botzilla: detecting the phoning home of malicious software. In: Proceedings of the 2010 ACM Symposium on Applied Computing (ACSAC 2010) (2010)Google Scholar
  45. 45.
    Rieck, K., Trinius, P., Willems, C., Holz, T.: Automatic analysis of malware behavior using machine learning. J. Comput. Secur. 19(4), 639–668 (2009)CrossRefGoogle Scholar
  46. 46.
    Rossow, C., Dietrich, C., Bos, H.: Large-scale analysis of malware downloaders. In: Flegel, U., Markatos, E., Robertson, W. (eds.) DIMVA 2012. LNCS, vol. 7591, pp. 42–61. Springer, Heidelberg (2013)CrossRefGoogle Scholar
  47. 47.
    Rutkowska, J.: Red Pill... Or How To Detect VMM Using (Almost) One CPU Instruction (2004). http://www.securiteam.com/securityreviews/6Z00H20BQS.html
  48. 48.
    Payload Security: Free Automated Malware Analysis Service. https://www.hyblid-analysis.com/
  49. 49.
  50. 50.
    ThreatTrack Security. Free Online Malware Analysis. http://www.threattracksecurity.com/resources/sandbox-malware-analysis.aspx
  51. 51.
    Symantec. Internet Security Threat Report 04/2015 (2015). http://www.symantec.com/de/de/security_response/publications/threatreport.jsp
  52. 52.
  53. 53.
    Vasudevan, A., Yerraballi, R.: Cobra: fine-grained malware analysis using stealth localized-executions. In: Proceedings of the 2006 IEEE Symposium on Security and Privacy, S&P 2006 (2006)Google Scholar
  54. 54.
    Vidas, T., Christin, N.: Evading android runtime analysis via sandbox detection. In: Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security, ASIA CCS 2014 (2014)Google Scholar
  55. 55.
    VirSCAN.org. Free Multi-Engine Online Virus Scanner. http://www.virscan.org/
  56. 56.
    Yoshioka, K., Hosobuchi, Y., Orii, T., Matsumoto, T.: Your sandbox is blinded: impact of decoy injection to public malware analysis systems. J. Inf. Process. 52, 3 (2011)Google Scholar

Copyright information

© Springer International Publishing Switzerland 2016

Authors and Affiliations

  • Akira Yokoyama
    • 1
  • Kou Ishii
    • 1
  • Rui Tanabe
    • 1
  • Yinmin Papa
    • 1
  • Katsunari Yoshioka
    • 1
  • Tsutomu Matsumoto
    • 1
  • Takahiro Kasama
    • 2
  • Daisuke Inoue
    • 2
  • Michael Brengel
    • 3
  • Michael Backes
    • 3
  • Christian Rossow
    • 1
    • 3
  1. 1.Yokohama National UniversityYokohamaJapan
  2. 2.National Institute of Information and Communications TechnologyKoganeiJapan
  3. 3.Center for IT-Security, Privacy, and Accountability, CISPASaarland UniversitySaarbrückenGermany

Personalised recommendations