Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Tailoring Sandbox Techniques to Hidden Threats

Summary: Palo Alto Networks' Unit 42 describes two sandbox adaptations: "dependency emulation," which lies to malware about missing DLLs so samples like ATMSpitter and Sality-infected files can get past the Windows loader and detonate, and virtual machine introspection that extracts TLS master secrets from ncrypt.dll memory to decrypt C2 traffic without meddler-in-the-middle interception. The platform processes roughly a million unique Windows executables daily, and the extracted keys are fed to Wireshark via ssl.keylog_file to decrypt HTTPS downloads, demonstrated on a FormBook sample.

Why it matters: Malware that fails to load because a DLL is absent yields no dynamic analysis at all, and TLS interception is detectable through certificate validation - so the sandbox's ability to adapt to each sample, rather than the volume of samples it runs, is what determines whether the C2 traffic is ever seen.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related