Sandbox Ideas

[tech_guy]

I need to create a mini standalone network where the attached client sees itself as connected to the Internet. This is to launch a suspected rootkit I believe is on the machine but hasn't been detected by any of the dozen or so programs I've scanned it with.

 

I don't want to connect the PC to my networks or at work for obvious reasons, so was wondering if I could create a sandbox environment where I could trick the infected machine into thinking it is attached to the Internet so I can examine the rootkit, which certainly seems to only activate when it is connected to the Internet?

[Arthur]

JoeBox might be an easier option?

 

Joebox is an extensive runtime analysis system with a special concept. It is designed for automatic runtime analysis of malware and other software on Windows based operating systems.

 

Key Features

• Modular design and structure
  
• CSV, TXT and HTML based behaviour analysis reports
  
• 100% complete network traffic reports
  
• Applicable on Windows XP, Windows Vista and Windows 7
  
• Runs on virtual, emulated and native systems
  
• Ability to build and differentiate behaviour baselines
  
• Reputation based system call evaluation
  
• Scalable to analyse several binaries at once
  
• Analyses any binary (exe, dll, sys, doc, pdf, ..)
  
• Fully scriptable
  
• Simply extensible
  
• Highly configurable
  

[kmount]

Depends how involved you fancy getting but depending upon how the malware identifies 'internet' (one would imagine dns look up for external domain) you could have a static IP configured on the box, false gateway address and real DNS servers on your internal subnet should be enough to let it start it's stuff.

 

Or you could let it fire up and 'get' internet access but then just firewall it from the router denying all traffic except DNS.

[Arthur]

Another program you may find useful is Buster Sandbox Analyzer for Sandboxie. More details here...

 

http://www.raymond.cc/blog/archives/2010/07/30/buster-sandbox-analyzer-makes-sandboxie-stronger/

[Edu-IT]

I can point you in the direction of somebody who works for one of the AV firms who might be interested at looking into this. He researches all this kind of thing.