What is a sandbox, and why do you need one to analyze malware?
A sandbox is an isolated computer and network environment designed for analyzing software behavior. This environment is typically designed to run risky files and determine whether those files pose a malware threat. Some sandboxes are also designed to examine URLs to determine whether they are suspicious and could lead to malware infection. Modern sandboxes enable businesses and individuals to test any type of file, including Microsoft Office files, PDF files, and executable files.
VirusTotal Malware Analysis Tool
Virus Total is an online service that uses antivirus engines and website scanners to analyze suspicious files and URLs in order to detect different types of malware and malicious content. It provides an API through which users can access the data generated by VirusTotal.
Cyber security and professionals use the free VirusTotal online service, but there is also a paid version that allows you to analyze files or URLs in order to identify malware detectable by antivirus engines, and it is one of the most popular in the community, so we decided to get a piece of that action.
Joe Sandbox Malware Analysis Tool
The free version of Joe Sandbox enables users to send files, browse a URL, download and execute a file or submit a command line. It works for Windows operating systems, macOS, Android, Linux, and iOS, making it a complete solution for customers with a large variety of operating systems in their IT infrastructure.
The only Windows systems accessible in the free version are a Windows 7 64-bit virtual machine and a Windows 10 64-bit physical machine. Other systems are available in the Cloud Pro service. Not many sandboxes offer the possibility of running files in a real physical system, which is one of the greatest features of Joe Sandbox.
ANY.RUN Malware Analysis Tool
ANY.RUN sandbox supports parsing public submissions. In this manner, an analyst can first search the database for any known indicator of compromise (IOC) and malware to see if it has already been publicly analyzed and then obtain the results. It contains millions of public submissions and is updated daily.
ANY.RUN's free version allows users to send files or URLs to a Windows 7 32-bit virtual machine, while the paid version allows users to send files to Windows Vista, Windows 8, and Windows 10.
The most powerful feature of ANY.RUN is the ability to interact in real-time with the virtual environment that runs the suspicious file or URL. Once a file is submitted, the user has 60 seconds to interact with the entire environment (or more on paid plans). This is a fantastic feature when analyzing malware that waits for specific user actions before running any payload. Consider malware that quietly waits for the user to launch a specific application (such as a browser) or to click on a dialog box. This is where the sandbox comes in handy.
What are some alternatives?
When comparing VirusTotal and Joe Sandbox, Any.Run you should also take into the following products.
Cuckoo Sandbox - Cuckoo Sandbox provides a detailed analysis of any suspected malware to help protect you from online threats.
Hybrid-Analysis.com - Hybrid-Analysis.com is a free malware analysis service powered by payload-security.com.
Jotti - Jottis malware scan is a free online service that enables you to scan suspicious files with several...
Metadefender - Metadefender, by OPSWAT, allows you to quickly multi-scan your files for malware using 43 antiviruses.
Falcon Sandbox - Submit malware for analysis with Falcon Sandbox and Hybrid Analysis technology. CrowdStrike develops and licenses analysis tools to fight malware.
What is Malware Analysis? Malware analysis is the process of determining the behavior and intent of a suspicious file or URL. The analysis' output aids in the detection and mitigation of a potential threat. Reverse engineering, sometimes called back engineering, is a process in which software, machines, aircraft, architectural structures, and other products are deconstructed to extract design information from them. Often, reverse engineering involves deconstructing individual components of larger products. Reverse engineering malware involves disassembling (and sometimes decompiling) a software program. Through this process, binary instructions are converted to code mnemonics (or higher-level constructs) so that engineers can look at what the program does and what systems it impacts.
