427 Botnet fm qxd

www.syngress.com
374
Chapter 10 • Using Sandbox Tools for Botnets
427_Botnet_10.qxd 1/9/07 3:06 PM Page 374

---

creationdistribution="OPEN_EXISTING" desiredaccess="FILE_ANY_ACCESS"/>

Sometimes malware does not try to stop found security services but
instead to modify their configuration such that the malware is not detected or
is enabled to circumvent the security mechanisms. For the Windows Firewall
this could be done using the 
netsh
command or by directly modifying the
corresponding registry key:
C:\WINDOWS\sysbinar\bin3.exe enable" showwindow="SW_HIDE"/>

Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List"
subkey_or_value="C:\WINDOWS\sysbinar\bin3.exe"
data="C:\WINDOWS\sysbinar\bin3.exe:*:Enabled:enable"/>

N
OTE
CWSandbox includes rootkit functionality to hide its existence from
malware. Toward that end, all its objects, such as processes, windows,
modules, or handles, are hidden. You can deactivate this feature via
the configuration parameter 
HIDE_ENVIRONMENT,
but it is enabled by
default.
Determining How and 
Which C&C Servers Are Contacted
Most bots use a central C&C server for communicating with their botherder,
and normally they use the standard IRC protocol for that purpose.
CWSandbox detects such communication and reacts in two ways: First, all the
interesting connection information is extracted from the traffic, and second,
all received commands are deleted so that they never arrive at the malware’s
receiving function. Some bots use slight modifications of the IRC protocol,