Why Malware Analysis Goes Beyond Sandboxes

Hi everyone!
This is a short post to share a thought I had while working on a malware sample: Should we rely only on sandboxes?, I started thinking about this because the malware I was analyzing wasn’t detected by sandbox environments. Here I won’t be including the in-depth analysis of reversing golang binaries, we can explore it in a future post.

The context

I was analyzing a Linux-based GoLang binary that was designed to provide a password. Since we had sandbox environments, we simply uploaded it to see if it was safe or not.

The results from CAPE Sandbox were clean (though it was a simple CAPE setup and required some further tuning). However, when I uploaded this binary to an enterprise EDR sandbox, the results were also same (treated as not suspicious), which was interesting and weird at the same time. So I was curious about this behaviour and tried manual analysis.

Role of Reverse Engineering

This is where reverse engineering comes into play. To start with, we don’t need to be an “ultra pro” to figure out whether a sample missed by sandbox is actually malicious.

In our case, this particular sample was stripped but not obfuscated. Just opening it in IDA and debugging it with radare2 gave a clear picture of how the sample works. Even if it had been obfuscated, we could still have identified the malicious signs.

During the dynamic analysis, I found some urls from the sample which was not given by the sandbox environments.

Apparently, there were some authentication mechanisms for the URL that were revoked. As a result, the execution wasn't completed, which maybe a reason for EDR sandbox to not detect anything or simply got exited due to Anti-VM techniques. However, the sandbox still failed to extract the URLs.

In the end, the malware sample was attempting to download files from a URL and execute them, effectively acting as a dropper.

Thanks to reverse engineering, I was able to extract more IOCs and a better understanding of how each functions in the sample works. So, in addition to using sandboxes, we should also perform reverse engineering whenever needed to verify the results.

Where to learn Reverse Engineering

Starting with programming fundamentals and basic assembly instructions will give you a great head start on the path to reverse engineering. And always remember one thing : learn by doing.

Here are some of my favourite learning sources :-
Crackme Challenges
Github - Awesome Reversing
Youtube - OALabs
Youtube - Dr Josh Stroschein
Youtube - pwn.college