427 Botnet fm qxd

www.syngress.com
Using Sandbox Tools for Botnets • Chapter 10
373
427_Botnet_10.qxd 1/9/07 3:06 PM Page 373

---

process and 
/f
forces its termination. Again, we present only a short extract of
the real analysis report output:





…


As a further example, we present malware that searches for the main win-
dows of known antivirus scanners. We do not know what would happen if a
searched window would be found, but this is not very hard to guess:








…

Some malware tries to find running debuggers and other activity-moni-
toring tools, which can be used for malware code analysis, by trying to open
their devices. In our example, these are 
SICE
and 
NTICE
(NT version) for
the 
Softice
debugger and 
FileMon
3.
and 
RegMon
4
, the famous tools from
www.sysinternals.com. Again, we do not know what would happen if one of
the queried devices existed. Most probably the application would crash the
system or simply not perform any of its malicious operations in order to not
reveal anything.

creationdistribution="OPEN_EXISTING" desiredaccess="FILE_ANY_ACCESS"/>
creationdistribution="OPEN_EXISTING" desiredaccess="FILE_ANY_ACCESS"/>
creationdistribution="OPEN_EXISTING" desiredaccess="FILE_ANY_ACCESS"/>