Chapter 10 - Using Sandbox Tools for Botnets

Abstract

This chapter discusses the malware analysis using the CWSandbox tool. It reviews the general sandbox architecture and its components. The results achieved on live sandbox systems, by successfully analyzing more than 10,000 malware samples—are also discussed. The CWSandboxis an application for the automatic behavior analysisof malware. This dynamic analysis is performed by executing this application in a controlled environment and catching all its relevant calls to the Windows API. Since these API calls are used for accessing Windows system resources such as files, the registry, or the network, all the malware's actions can be examined. In the next step, a high-level summarized report is generated from this monitored data. CWSandbox is not only used to create analysis reports for single malware samples, but also integrated into a bigger system, the automated analysis suite (AAS). This suite consists of several software components and is used to collect and analyze malware automatically.