One of the most important rules in building dynamic analysis environments is to avoid internet connection by the “potential malicious code”. Indeed the “potential malicious code” would try to exploit the analysis system per se if an internet connection is available. To respect this basic rule, when a sandboxed code tries to open an internet page, the sandbox environment sends back a static 200 code, letting the “potential malicious code” compare the received page to the needed one. At such point the analysis system might try to “taint” and/or to apply its own detection mechanisms.
A smart way to detect if a code is sandboxed or not is to try to reach out an unreachable internet site. If the code reads back 200 means the malicious code has been sandboxed since the malicious code is trying to reach an unreachable page. Following a simple python example.
Following a simple JavaExample of the aforementioned technique.
|A Java Example|
Another tipycal example written in C
That trick has been known since 2012. Have a nice evasion.