VirusTotal MultiSandbox += SNDBOX

Today, VirusTotal is happy to welcome SNDBOX to the Multi-sandbox project. SNDBOX is a cloud based automated malware analysis platform. SNDBOX advanced dynamic analysis capabilities gives additional insights and visibility intro a variety of file-types.

In their own words:

• SNDBOX malware research platform developed by researchers for researchers and provides static, dynamic and network analysis. 

• SNDBOX is the first malware research solution to leverage multiple AI detection vectors and undetectable kernel driver analysis. 

• SNDBOX kernel agent is located between the user mode and kernel mode. The agent has the ability to detect all malicious activities going from the running application to its execution in the operating system.

• SNDBOX technology delivers in-depth results, quickly while providing AI and big data insights necessary for comprehensive malware research and false positive rate reduction.

Highlighting some examples

Detecting ZBOT variant, with high visibility to “Process Hollowing” and “Process Injection” techniques used by the malware.

SHA256 Hash	a1eeed427f152ddf2bfb2dee5ab01381509378e41c6b1401bcb761fc54a7b1b2
VirusTotal SNDBOX Report	https://www.virustotal.com/gui/file/a1eeed427f152ddf2bfb2dee5ab01381509378e41c6b1401bcb761fc54a7b1b2/behavior/SNDBOX
SNDBOX	https://app.sndbox.com/sample/cf951a70-fc4d-47e3-a3f3-ebcbc5a4403e

On the SNDBOX site you can see malicious network domains, as well as enabling next stage file analysis of dropped files found in analysis.

For VirusTotal Enterprise users, you may click on the mutex, to search for other samples with this same mutex. 

This links to a search of behavior:"7EF531C0" which will lead you to other behaviour reports with the same mutex name.

Revealing malicious network domains, as well as enabling next stage file analysis of dropped files found in analysis.

SHA256	6fd379025d2a93ede1545c580928c880e54b8be9f523c47de27cc6e3922e9f01
SNDBOX report on VirusTotal	https://www.virustotal.com/gui/file/6fd379025d2a93ede1545c580928c880e54b8be9f523c47de27cc6e3922e9f01/behavior/SNDBOX
SNDBOX	https://app.sndbox.com/sample/65237b0a-9a81-4eb9-8b11-c597ada4a475

 

On VirusTotal take note of the DNS resolutions, and dropped files.  Dropped files are defined as the interesting files that are written to disk by the sample under analysis. 

Pykspa variant, network activity detected with Suricata and dropped files being sent for second stage analysis & detection:

SHA256 Hash	24a40a49c7de06953a516b4968a56b5432b4db310feb9a93e15625823f6d398b
VirusTotal	https://www.virustotal.com/gui/file/24a40a49c7de06953a516b4968a56b5432b4db310feb9a93e15625823f6d398b/behavior/SNDBOX
SNDBOX	https://app.sndbox.com/sample/5a385e75-ca90-40c0-bb39-b8dbdce4cc23

Within the “Registry Keys Set” section we find that the sample is set to RunOnce on next startup, possibly a method to achieve persistence. 

VT Enterprise customers can click on the registry value which uses the “behavior_registry” search modifier  to search for other files that also use the same registry value:  behavior_registry:"nrsyjl"  

Bancteian variant data stealer caught and detected by SNDBOX's signatures:

SHA256 Hash	c6aff975f52f401ca64b272bd5a00bd5b73113d4e930397de531478982e2245f
VirusTotal	https://www.virustotal.com/gui/file/c6aff975f52f401ca64b272bd5a00bd5b73113d4e930397de531478982e2245f/behavior/SNDBOX
SNDBOX	https://app.sndbox.com/sample/80b95810-ffbd-48a0-8102-467961610d3a

Within the SNDBOX report check out the detections: