Instructor: Another way to discover malicious files 2 2
is to use a sandbox. 3 3
A sandbox is, basically, a place 4 4
where your file will be executed and analyzed. 5 5
They will check if any ports will be opened, 6 6
if it's gonna modify registry entries, 7 7
if it's gonna do any suspicious (mumbles). 8 8
It's not an antivirus program. 9 9
Your Trojan might pass antivirus programs like we did. 10 10
Our Trojan passes all antivirus programs. 11 11
But the sandbox applications or the sandbox environments 12 12
will run this into a place, into a controlled environment, 13 13
and try to see if it does anything suspicious 14 14
and give you a report of that. 15 15
You can Google, again, sandbox online. 16 16
An example of it is a website called hybrid-analysis. 17 17
Using the website is very simple. 18 18
All you have to do is just go to the URL, 19 19
and select your file, and upload it. 20 20
Now, I've done this already, 21 21
so I'm just gonna show you the report 22 22
because analyzing the file and doing the report 23 23
might take some time. 24 24
Once you get the report, 25 25
you'll see some basic information. 26 26
You'll see that there was, 27 27
malicious indicators have been found. 28 28
Now, it's hiding it from you, and you have to 29 29
use the full version and pay for it to see them, 30 30
but you don't really need to see them. 31 31
If you read the whole report, 32 32
you'll be able to know that this file is malicious 33 33
and it's gonna do something bad on your computer. 34 34
First of all, you can see that the file 35 35
suppresses error boxes. 36 36
It doesn't display error boxes. 37 37
It also modifies registry. 38 38
You can see the registry parameters that it's modifying. 39 39
You can see that it's playing with the internet settings, 40 40
and with the connections. 41 41
You can also see that it's using Windows Socket service, 42 42
so it's trying to create connections. 43 43
You can also see that it's playing 44 44
with the address of the process. 45 45
Scrolling down, 46 46
you'll see one of the most important indicators. 47 47
Now, obviously, there's more information in here. 48 48
Right here on the network place, 49 49
you'll see that it tries to connect to this IP on port 8080. 50 50
Now, again, you can go on this IP 51 51
and do a reverse DNS lookup, 52 52
and see that this IP is not related to any website. 53 53
Also, this, when you upload the payload to this place, 54 54
it's never gonna be executed on your computer, 55 55
it's gonna be executed on their server 56 56
in a sandbox environment. 57 57
Now, obviously, the method I showed you, 58 58
you should always do it in a virtual box 59 59
when you are executing it here on your Windows. 60 60
Always do it in a virtual machine, 61 61
don't do it on your main machine. 62 62
Or, you can use this method 63 63
where you upload it into a sandbox environment. 64 64
It'll analyzed for you, 65 65
and then you can read the report.