3 ms·
From what I've read, it's not uncommon for these types of malware to implement similar schemes. They send the HTTP requests to one of N domains over some period
by dvdhnt 9y ago
From what I've read, it's not uncommon for these types of malware to implement similar schemes. They send the HTTP requests to one of N domains over some period of time in order to detect whether or not the malware is being run inside of a sandbox. If the IP of every response matches, they cease to operate. Their intention, it seems, is to avoid in-depth analysis by researchers, hoping to prolong the malware's lifespan. However, in this particular case, such a check had the opposite effect.
- seanwilson 9y agoIs there a safe way a sandbox could mock these HTTP requests to trip up the sandbox detection?
- giomasce 9y agoIt is very implausible. A sandbox detection algorithm has a lot of different options on what to observe to decide whether it is running in a "genuine" environment or in an "artificial" one. You probably have to see what every single sandbox detector is doing and cook up something specific for that.