427 Botnet fm qxd

www.syngress.com
386
Chapter 10 • Using Sandbox Tools for Botnets
427_Botnet_10.qxd 1/9/07 3:06 PM Page 386

---

■
Querying the DNS server for address resolution
■
Sending and receiving UDP data
■
Connecting via TCP to a remote host
■
Setting up a TCP server for accepting connections
■
Accepting incoming TCP connections
■
For recognized application protocols, the used protocol-dependent
data is displayed, such as username, password, nickname, mail receiver,
mail content, and performed FTP commands
It has turned out that the use of CWSandbox for automatic behavior
analysis brings a big benefit in malware research. Nevertheless, though the
received analysis results normally are very comprehensive and detailed, one
has to be aware that there is never an assurance of their completeness. First,
because a sandbox usually monitors only one single execution path of an
application, only the actions that are performed on this path can be reported.
There is no guarantee that there are no other malicious operations that are
only triggered under certain conditions which were not met during the anal-
ysis run. Second, there are many tricks to either detect a sandbox or to per-
form operations in a way the sandbox is not able to track. Accordingly, the
sandbox is a great research tool, but you should not rely completely or solely
on it.Think of it as one more tool in a defense-in-depth strategy.
Solutions Fast Track
Describing CWSandbox
Sandboxes are a common tool in security/malware research; they
allow the execution of unknown software in a controlled, restricted,
and monitored environment.
CWSandbox is a tool for automatic behavior analysis of Windows
executables.The following steps are performed:
■
The initial malware process is created by the starter application,
cwsandbox.exe.
■
Cwmonitor.dll is injected into each monitored process.