427 Botnet fm qxd

www.syngress.com
Using Sandbox Tools for Botnets • Chapter 10
381
427_Botnet_10.qxd 1/9/07 3:06 PM Page 381

---

Finally, a lot of malware tries to steal sensitive data from the local host.
This can be done by installing a keylogger or by directly accessing the places
where such data is stored.The explicit process of keylogging is not detected
by current version of CWSandbox and will be added as a new feature in
coming releases. Nevertheless, because some files need to be installed as an
autostart application or as a service or driver for that purpose, this will
become obvious by examining the report. If the malware tries to read the data
directly from its storage location, this could happen in several ways, depending
on that location. Examples for retrieving dialup network configuration data
and contents of address books for several mail clients are these (note that
some malware uses 

and other malware uses 

or even

to check for the existence of such files):


Anwendungsdaten\Microsoft\Network\Connections\Pbk\*.pbk"/>
Data\Qualcomm\Eudora\NNdbase.txt" creationdistribution="OPEN_EXISTING"/>
Data\The Bat!\TheBat.ABD" creationdistribution="OPEN_EXISTING"/>

In Windows 2000 the 
Protected Storage Service
was introduced.This is a ser-
vice for storing sensitive data such as passwords or private keys in a protected
and encrypted way. It is used to save the passwords that have been entered in
Internet Explorer or Microsoft Outlook and Outlook Express, but it also can
be used by any other user application to protect its sensitive data. For that
reason it is an open treasure chest for each malicious application. CWSandbox
detects all accesses to this Protected Storage and reports them in a

.
An example of such a report follows:

subtypename="Subscriptions"/>