Slime - Automated Anti-Sandboxing Disarmament System
Explore an automated disarmament system for malware equipped with anti-sandboxing techniques in this Black Hat conference talk. Delve into the challenges posed by sophisticated malware like Citadel and Zeus/GameOver that employ host-fingerprinting and other evasion tactics. Learn about the SLIME system's approach to disarming malware, focusing on exit reasons and pre-activity termination. Discover key technologies such as malware palpation, Code Execution Integrity, and retroactive condition analysis. Examine the implementation of execution logging frameworks and techniques for camouflaging VM/sandbox artifacts. Witness a disarming demo targeting anti-VMWare and sandbox evasion techniques. Gain insights into the prevalence of anti-VM malware and discuss the effectiveness of virtual machines in malware protection. This comprehensive presentation provides valuable statistics on evasive malware in the real world and reports on large-scale sample analysis results.