Slime: Automated Anti-Sandboxing Disarmament System
summary
A prototype called SLIME uses a CPU-emulator to fake VM/sandbox artifacts (registry keys, BIOS strings, backdoor port behavior) and computes a per-instruction code execution integrity digest plus retroactive condition analysis to locate branch checks that cause early exit. It processes samples at about 6–10 seconds each and was tested against ~19,900 samples drawn from a 5M corpus, finding a small but real set of anti-sandbox malware; coverage and stability remain limited.
AI-written summary · about
chapters (32)
- 0:00Intro
- 2:14Contents
- 3:14Background
- 4:13Use the sandbox, Luke
- 5:28Malware strike back
- 6:08Related work
- 7:42Motivation
- 8:13Challenges
- 8:44black hat
- 12:14Chthonic anti-sandboxing
- 12:45Type of anti-sandboxing
- 14:40Environment awareness
- 16:11Artifact fingerprinting
- 17:07Execution environment fingerprinting
- 17:40Execution timing detection
- 19:02SLIME key technologies
- 19:26Concept: malware palpatio
- 20:19Malware palpation
- 21:05Code Execution Integrity CEI
- 21:53Execution branch detection
- 22:40Retroactive condition analysis
- 23:54Implementation
- 24:53Execution logging framework
- 25:33Camouflaging VM/sandbox related artifact existence
- 32:02Disarming demo
- 32:33Anti-VMWare
- 33:34Sandbox evasion
- 34:56Dataset
- 36:32Are Anti-VM Too Few?
- 37:49Offtopic: Artifact finding by Yara
- 38:58Can Virtual Machine Protects You from Malware?
- 40:37Conclusion
related talks
51mFull System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
21mAutomating dynamic malware analysis
41mFreeze Drying for Capturing Environment-Sensitive Malware Alive
21mDetection of Advanced Attacks with a CPU Level Sandbox Technology
56mAutomating Linux Malware Analysis Using Limon Sandbox
35mEnter Sandbox
45m"Advanced Malware Threat: handling obfuscated code using..."
23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis