<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Thorsten Holz wrote:
<blockquote
cite="mid:5603eb730802210751w25526e4atc283a9eee19a6415@mail.gmail.com"
type="cite">
<pre wrap="">On Thu, Feb 21, 2008 at 1:54 PM, Dave Aitel <a class="moz-txt-link-rfc2396E" href="mailto:dave@immunityinc.com"><dave@immunityinc.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap=""> There's another one called CWSandbox that has a free web form you can
send exe's to.
</pre>
</blockquote>
<pre wrap=""><!---->
You can either send a sample to <a class="moz-txt-link-rfc2396E" href="https://cwsandbox.org/?page=submit"><https://cwsandbox.org/?page=submit></a>
or <a class="moz-txt-link-rfc2396E" href="http://research.sunbelt-software.com/submit.aspx"><http://research.sunbelt-software.com/submit.aspx></a>
More info about the tool is available in an article
(<a class="moz-txt-link-rfc2396E" href="http://pi1.informatik.uni-mannheim.de/filepool/publications/j2holz.pdf"><http://pi1.informatik.uni-mannheim.de/filepool/publications/j2holz.pdf></a>)
and an example report is
<a class="moz-txt-link-rfc2396E" href="https://cwsandbox.org/?page=details&id=156851&password=iokop"><https://cwsandbox.org/?page=details&id=156851&password=iokop></a>
</pre>
<blockquote type="cite">
<pre wrap="">(They hook a bunch of things but I think you can escape
the hooking by calling system calls directly?)
</pre>
</blockquote>
<pre wrap=""><!---->
</pre>
</blockquote>
<br>
One thing I like about sandboxes is that they take a higher level view
of malware than a debugger type tool or IDA. (So they tend to scale
better than hiring more of us RE guys.) So even if the malware has
some crazy way of sending network data that isn't hooked by most tools
... shouldn't a good sandbox basically just have something like
wireshark watching? That way you're (relatively) sure you'll catch all
net traffic? As for malware being able to detect and poop-out if in a
virtual environment, perhaps the CW guy can speak to that? I think
that's a real problem for most virtual environments like a sandbox. So
if its super critical we find out exactly what the malware is doing,
and scaling is not a problem, perhaps a physical (but air gapped) net
is the only way to role?<br>
<br>
Jared<br>
<br>
<blockquote
cite="mid:5603eb730802210751w25526e4atc283a9eee19a6415@mail.gmail.com"
type="cite">
<pre wrap="">But then you are not platform independent. CWSandbox was originally
designed to automatically analyze the malware we capture with the help
of honeypots (worms, bots, ...), but has evolved a lot since then.
Cheers,
Thorsten
_______________________________________________
Dailydave mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Dailydave@lists.immunitysec.com">Dailydave@lists.immunitysec.com</a>
<a class="moz-txt-link-freetext" href="http://lists.immunitysec.com/mailman/listinfo/dailydave">http://lists.immunitysec.com/mailman/listinfo/dailydave</a>
</pre>
</blockquote>
<br>
</body>
</html>