Symbolic Execution of Malicious Software: Countering Sandbox Evasion Techniques

Intro Evasion Study Extension Evaluation Conclusions
Symbolic Execution of Malicious Software:
Countering Sandbox Evasion Techniques
Fabio Rosato
Advisors: Camil Demetrescu, Daniele Cono D’Elia
October 24, 2017
Master of Science in Engineering in Computer Science
1 / 20 Fabio Rosato M.Sc. Engineering in Computer Science

Intro Evasion Study Extension Evaluation Conclusions Malware analysis Symbolic execution
Malicious software - An ever growing threat

Malware analysis
Static analysis Dynamic analysis

Concrete execution - Example
int foo() {
int x = 1;
int y = read_int();
int z = y * 2 + x
if (z == 13) {
return ERROR;
} else {
return SUCCESS;
}
}

int foo() {
int x = 1;
int y = read_int(); 3
int z = y * 2 + x
if (z == 13) {
return ERROR;
} else {
return SUCCESS;
}
}

int foo() {
int x = 1;
int y = read_int(); 3
int z = y * 2 + x 7
if (z == 13) {
return ERROR;
} else {
return SUCCESS;
}
}

Symbolic execution - Example
int foo() {
int x = 1;
int y = read_int();
int z = y * 2 + x
if (z == 13) {
return ERROR;
} else {
return SUCCESS;
}
}

int foo() {
int x = 1;
int y = read_int(); λ
int z = y * 2 + x
if (z == 13) {
return ERROR;
} else {
return SUCCESS;
}
}

int foo() {
int x = 1;
int z = y * 2 + x λ * 2 + 1
if (z == 13) {
return ERROR;
} else {
return SUCCESS;
}
}

int foo() {
int x = 1;
int z = y * 2 + x λ * 2 + 1
if (z == 13) { Forking!
return ERROR;
} else {
return SUCCESS;
}
}

int foo() {
int x = 1;
int z = y * 2 + x λ * 2 + 1
if (z == 13) { Forking!
return ERROR;
£
¢

¡if λ * 2 + 1 == 13
} else {
return SUCCESS;
£
¢

¡if λ * 2 + 1 != 13
}
}

Symbolic execution of malware
Symbolic execution applications have been
practically exclusively conﬁned to general
software testing, with excellent results.
The ability to potentially cover all possible execution
paths and subsequently identify the corresponding
concrete input values that would elicit them, make it
an ideal instrument for the study of the trigger-based
behaviors extremely common in malware.

Intro Evasion Study Extension Evaluation Conclusions Deﬁnition Problem
Malware evasion deﬁned
Malware evasion
The set of techniques employed by malware to avoid being detected
by an automated dynamic analysis product.
An evasive malware is a malware that exhibits no malicious behavior
in a sandbox, but that infects the intended target.
if observed:
act_innocent()
else:
do_bad_things()

Intro Evasion Study Extension Evaluation Conclusions Deﬁnition Problem
The problem with malware evasion
Evasive checks represent critical branching points

Intro Evasion Study Extension Evaluation Conclusions Evasion categorization API pattern study
Contribution: malware evasion categorization
Evasion
Proactive-Attack
Instruction-based
Time-based
Reactive-Detection
Reverse-Turing-Tests
Time-based
Hardware-based
Artifact-based
File-system
Process
OS

Contribution: common Windows API interaction patterns
Category
Check
Involved APIs
OS artifacts detection
Registry key presence RegOpenKeyEx
RegOpenKeyEx
Registry key value
RegQueryValueEx
User name GetUserName
Process enumeration CreateToolhelp32Snapshot
Windows FindWindow

Category
Check
Involved APIs
Process artifacts detection
Hooks -
Injected DLLs GetModuleHandle
IsDebuggerPresent
OutputDebugStringDebugging
CheckRemoteDebuggerPresent

Category
Check
Involved APIs
File system artifacts detection
GetFileAttributes
File system artifact presence
CreateFile
Execution path GetModuleFileName
GetLogicalDriveStrings
Common ﬁle names
GetFileAttributes

Category
Check
Involved APIs
Hardware-based detection
Single-CPU GetSystemInfo
Small amount of RAM GlobalMemoryStatusEx
DeviceIoControl
Small drive size
GetDiskFreeSpaceEx
CPUID ﬁngerprinting CPUID
Network adapter details GetAdaptersAddresses

Category
Check
Involved APIs
Time-based detection
GetTickCount
Sleep patched
Sleep
Uptime GetTickCount
RDTSC timing RDTSC
Network adapter details GetAdaptersAddresses
Reverse Turing tests
Mouse movement GetCursorPos

Contribution: Angr anti-evasion extension
Angr: an open source python framework for
analyzing binaries that combines both static and
dynamic symbolic analysis (http://angr.io/).

Contribution: Angr anti-evasion extension
Constrain the symbolic exploration to pass the evasive detection checks

Intro Evasion Study Extension Evaluation Conclusions Paranoid Fish Kasidet malware
Extension evaluation - Paranoid Fish
Paranoid Fish: open source tool that demonstrates several
techniques employed by malware families to detect
whether they are being executed in an analysis
environment, be it a debugger, a VM, or a sandbox.
57 diﬀerent checking functions
Unaided Aided by extension

Intro Evasion Study Extension Evaluation Conclusions Paranoid Fish Kasidet malware
Extension evaluation - Kasidet
Kasidet malware: backdoor, gathers information and communicates
with a C&C server, allowing a remote attacker to
take over the infected machine by exchanging ﬁles
with the server and executing shell commands.
Sample de1af0e97e94859d372be7fcf3a5daa5.
17 diﬀerent detective evasion functions
Unaided Aided by extension

Conclusions - Summary
Thesis focus:
improving the applicability of symbolic execution to the
malware domain by patching evasion techniques.
Contributions:
high level categorization of evasive techniques
Windows API interaction patterns study for the most
widespread detective evasion techniques
Angr anti-evasion extension

Thesis, slides, and code are all available at
https://github.com/fabros/angr-antievasion
Thank you!
Fabio Rosato
rosato.1565173@studenti.uniroma1.it

Symbolic Execution of Malicious Software: Countering Sandbox Evasion Techniques

More Related Content

Similar to Symbolic Execution of Malicious Software: Countering Sandbox Evasion Techniques (20)

Recently uploaded (20)

Symbolic Execution of Malicious Software: Countering Sandbox Evasion Techniques