Design and Implementation of Malware Dynamic
Analyzer using Network Emulator GINE
M2011MM048 MITSUEDA Yasuaki
Supervisor：OKUMURA Yasuyuki

1Introduction

Recently the number of malicious programs have been
increasing in a short period of time. We need to know
their behavior to cleanse them.
Although dynamic analysis is not able to ﬁgure out
exact malware behavior, it is able to analyze malware
behavior in a short period of time. It executes the binary in a disconnected Internet environment and analyzes malware behavior. However, there is a drawback
with dynamic analysis. Most malwares try to connect
to the Internet to connect to the corresponding serverthat malware’s creator prepares.
To overcome this drawback, there are two previous
works for emulating the network. The ﬁrst one is “Improving Isolated Sandbox using Fake DNS Server”[1]. It
use Isolated Sandbox using a number of computers. It
provide the Fake DNS service with malware. The fake
DNS service replies predeﬁned domain name or IP address in case the domain name or IP address are not in
the list.
Secondly, “Trumanbox”[2] uses two computers. One
computer provides malware with servers such as HTTP,
FTP, IRC, and SMTP. The other runs malware samples connected to one another. It redirects malware
traﬃc to servers using ebtables and iptables command.
This study analyzes the traﬃc to ﬁgure out malware behavior. Therefore, it redirects the traﬃc, only between
servers and malware. Furthermore, it provides the DNS
service which resolves the requested hostname to predeﬁned IP addresses.
In this paper, we extend previous research[3] in 2012.
We use the network emulator GINE[4] and the virtual
machine QEMU to make a disconnected the Internet environment on one computer. We make malware connect
to several virtual hosts and observe malware infection
action. In addition, by providing fake servers, we ﬁgureout malware behavior.

2

System Overview

Figure 1 System Architecture
sible to connect to QEMU host. Therefore, we use
virtual GINE switch, without assign IP addresses,
which is possible to make a connection between
QEMU host and GINE nodes.
• Virtual NAT Host
We translate, using iptables, virtual Windows OS’s
destination IP address into fake server’s IP address.
We conﬁgure iptables rule below.
“-d 0.0.0.0/0 -j DNAT -to-destination A.B.C.D”• Virtual Fake Servers
We provide malware with fake services such as
HTTP, FTP, IRC, SMTP and DNS.
Providing malware with fake servers, we always haveto assign IP address. Malware always tries to connect
to the original server. In this case, malware connects
to fake servers. For example (see Fig.1), virtual Windows host connects a DNS server’s IP address “A”. Virtual NAT host receives malware’s packets on veth1 andtranslates malware’s destination IP address into the fakeserver’s IP address “X”. In addition, it forward thepackets to the fake servers.
Secondly, we make a connection between malware andthe original server (see Fig.2).

In this section, we explain virtual networks using
QEMU and GINE.
2.1

Test Network Configuration

In this study, we make two virtual networks. The ﬁrst
one is the dissconected internet environment (see Fig.1).
• Virtual Windows Host
We install virtual Windows OS on QEMU. QEMU
is Open Source and it is possible to make a connection, using tap function, between guest OS and
GINE nodes. Therefore we use QEMU as a virtual machine. By using the virtual machine, we areable to clean up the guest machine. We explain themethod of connection between QEMU and GINE
node in section 3.1.
• Virtual Switch
Using kernel bridge, QEMU connects to the Internet directly. In this case, GINE nodes are impos-

Figure 2 The transparent proxy“vProxy” is a virtual GINE host and the transparend
proxy host. It only permits port 80(HTTP) and port
53(DNS) using iptables command to prevent the infection. We make malware connect to the original serverusing network bridge. The bridge can make a connection between NIC(eth0) and virtual NAT host’s NIC.

Therefore, we can make malware connect to the original
server with benign.
2.2

Network and Hosts Virtuarization

GINE(Goto’s IP Network Emulator) emulates
IPv4/v6 network which component some router andlink. GINE uses NETNS(Network Name Space) which
is a Linux kernel virtual host. It uses only network
virtualization and do not use ﬁle system nor process
virtualization since it is rather inconvenient for network
emulation purpose. Since network interfaces including
loopback interface(lo) and Unix domain sockets are
not shared among virtual network stacks and the hostOS s original network stack, a special virtual network
device, called Virtual Ethernet Pair(vethdevice), must
be used.
GINE can not emulate Windows hosts. Therefore, we
use QEMU to make networks including Windows hosts
and NETNS hosts. QEMU has a tap function to connect
to other virtual hosts.

3

Implementation
In this section, we explain the implementation.

3.1

Connection of Virtual Hosts and Routers

In this section, we explain the method to connect a
virtual QEMU host and internal GINE hosts[3]. In thecase of executing QEMU with default (user mode network), QEMU prepares NAT DHCP server, DNS serverand Samba server for guest OSs. Consequently, otherhosts are not able to connect to guest OSs since thereis the NAT DHCP server for guest OSs. Furthermore,
the guest OS can not connect to other guest OSs andthe host OS. Therefore, we use QEMU’s tap function.
Guest OSs are able to connect other hosts by tap function. To use tap function, we have to execute QEMU
with the options below.
• qemu -net nic, vlan=1 -net tap, vlan=1, ifname=tap0“-net nic” is an option which creates virtual network
card and “-net tap” connects tap device to QEMU.
We use these options to make the connection between
QEMU host and GINE host (see Fig.3).

Figure 3 Connection of QEMU host and GINE host
GINE uses NETNS and veth to make a connection
GINE hosts each other. Therefore, GINE hosts can not
make a connection to tap device. Then, we connect

veth1 to a virtual GINE switch which connect tap device. Therefore, we can make the connection between
GINE host and QEMU virtual host.
However, some malware detect the virtual environment and stop execution itself to prevent analysis. In
this case, we execute malware on a real computer. We
use two real computers (see Fig.4).

Figure 4 Using two real computers
One computer is a malware computer. The other one isa GINE computer which provides fake servers with malware. We connect the malware computer to the GINE
computer with a crossing cable. The virtual NAT hostconnects to the malware host by bridging. Fake servers
are the same as the previous section’s fake servers.
3.2

Fake Servers

SMTP and DNS are complicate mechanisms. Thus,
we use standard server software. For SMTP, we use
Postﬁx. In addition, we use NSD and Unbound for DNS.
• Fake DNS server
We use NSD for fake DNS root server and set up
fake DNS server on the virtual Internet and conﬁgure zone ﬁle (see below). Fake DNS server always
replies the same IPv4 address for A record query byusing wild-card. For AAAA query, it replies withthe same way. For reverse query, we implementa program which always replies the same domainusing unbound library. However, we do not implement this since it is low-priority[5].
zone ﬁle conﬁguration(IPv4)* IN A 1.2.3.4

We conﬁgured the zone ﬁle and set fake DNS
server’s IP address(Ex:1.2.3.4) on the IP ﬁeld. In
this case, the DNS server always replies same IPv4
address(1.2.3.4).
• Fake SMTP server
We use Postﬁx for fake SMTP server. We set up
this server on the virtual Internet. This server only
replies SMTP messages. it does not send E-mail forreal.
On the contrary, HTTP, FTP and IRC services are
simple mechanisms. Therefore, We use xinetd. xinetd isthe Internet services daemon. Each time accepting connections, xinetd starts services according to port number. In addition, xinetd is able to redirect access to another port. In the case of starting services, xinetd canrun server program and an arbitrary program. Hence,
we implement server program easily.
We implemented the fake HTTP server program. This
program always respond with same reply to malware.

This program reply these message below.

Messages of HTTP
HTTP/1.1 200 OK
Content-type: text/html

ply, if the reply is 200s, it removes the HTTP body andforwards the reply to the client (see below).

Original HTTP headers
HTTP/1.1 200 OK
Date: Tue, 11 Dec 2012 10:03:53 GMT
Server: Apache/2.2.14 (Ubuntu)
Last-Modiﬁed: Thu, 29 Nov 2012 06:45:40 GMT
ETag: ”7e22f2-10d-4cf9ca1aa15c0”
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 205
Content-Type: text/html<html><head></head><body><h1>Hello, world!</h1><?php
print (”fake script”);?></body></html>Malicious Code Message Body“200” is a HTTP message. It shows acceptance malware Malware gets a ﬁle by using HTTP get method. In therequirements. The fake HTTP sever always reply this case of HTTP response message being 200s, the proxymessages.
replaces original HTTP body with benign body(see beWe extended the ftpd[6] which is a opensource soft- low).
ware. In the case of using ID and password, the fake Replaced HTTP headers
FTP server ignores login ID and password which aresent. Therefore, malware always succeeds entering the
FTP server, as if malware used the correct ID and password. In addition, the fake FTP server accept anonymous login. Every time malware requires ﬁles, the fake
FTP server replies fake ﬁles according to ﬁle extension(exe, png, jpeg, jpg, gif, html, php and pdf). For
example, malware requires A.exe ﬁle. In this case, thefake FTP server replies fake.exe ﬁle. In addition, thefake FTP server reply image ﬁles because malware requires image ﬁles which embedded malicious code.
We identify protocol by well known port. However, insome malware, well knownport numbers are not used.
Identiﬁcation of protocol is important for our study.
Therefore, we identify protocol by payload protocol
identiﬁcation[2]. We identify protocol according to table 1. For example, There is “GET” in client’s payload.
Table 1 Protocol Identiﬁcation
Protocol
HTTP
IRC
FTP
SMTP

Pattern (at the beginnig)“GET /”“NICK ”
“220”
“220”

Pattern (somewhere)“ftp” (case insensitive)“mail” OR “smtp” (case insensitive)

We identify HTTP. If there is no payload, we identify
protocol according to destination port number.
3.3

Transparent Proxy with Body Removal

In some malware, our fake server can be detected.
Moreover, if malware can connect to the original server,
we can ﬁgureout exact behavior. Hence, we use transparent HTTP proxy. It forwards the original server
packets to malware. However, we should not forward
the original packets without any change. Therefore, we
implemented the transparent proxy with perl since perl
can manipulate text easily.
Client(malware) send http request to the original
server. When forwarding the request, we have to use
iptables command to redirect the packet to the transparent proxy. Then, the proxy establish the connection
with non blocking mode to make wait the connection.
In addition, it gets the client’s destination IP addressusing “getsockopt” function. It sends the request to theoriginal server by proxy. After receiving the HTTP re-

HTTP/1.1 200 OK
Date: Tue, 11 Dec 2012 09:35:35 GMT
Server: Apache/2.2.14 (Ubuntu)
Last-Modiﬁed: Thu, 29 Nov 2012 06:45:40 GMT
ETag: ”7e22f2-10d-4cf9ca1aa15c0”
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 31
Content-Type: text/html<html><body>HELLO!!</body></html>
The proxy removes HTTP body into “HELLO!!”. The
proxy does not do anything in the case of such as 300s,
400s and 500s. There is room to consider other protocol
such as FTP.

4

Experimental Results

We analyze malware samples from MWS(anti Malware engineering WorkShop) 2012 Datasets[7]. Thesesample are collected between 1st and 31th Jan. in 2012using 12 honeypots. In addition, We analyze samples
using fake servers in next section.
4.1

Malware Analysis with Fake Servers

We classiﬁed these 10538 samples using clamAV.
There were 17 classes and 11 samples which clamAV
could not detect malware. We analyzed 1 sample foreach class and the 11 samples (They are described in
the top 5 digit hash). Therefore, we analyzed 28 samples. We executed 28 samples on the virtual windows
XP for 10 minutes. 11 of 28 samples did not run on virtual Windows XP, virtual Windows 7(32bit,64bit) andWindows 7(64bit) on real a machine. We show the results of malware samples behavior (see Table.2). Then,
we captured malware traﬃc. We describe a part of malware behavior.
Allaple sent ICMP request to a host(219.151.X.X)
twice. Then, this sample tried to connect to the hostwith port 139(NETBIOS−SSN). We guess that it is a
infection action.
Trojan.Inject, Trojan.Jorik, Trojan.Injector, Trojan.Kazy, 42b2f, 8e915, ce891, 56404 and e0428 showedTable 2 Malware Classiﬁcation and Behavior
Class
AllapleTrojan.Inject
Trojan.Crypt
Trojan.Dropper.Agent
Trojan.IRCBot
Trojan.Injector
Trojan.Jorik
Trojan.Kazy
W32.Virut
42b2f...
8e915...
e95f7...
54932...
ce891...
56404...
8746e...
e0428...

Used protocol or port number
ICMP, netbios-ssn(port 139)
DNS
DNS, microsoft-ds(port 445), port 555
microsoft-ds(445), DNS, port 976
DNS, microsoft-ds(port 445), port 555
DNS
DNS
DNS
DNS, HTTP, port 555
DNS
DNS
HTTP, port 7007
netbios-dgm(port 138)
DNS
DNS
netbios-dgm(port 138)
DNS

same behavior. These samples sent same DNS request
of TXT record. Therefore, we conﬁgured fake DNS
server to reply TXT record and analyzed Trojan.Injector
again. This sample only continued TXT record request.
We guess that the action is DoS attack which using DNS
query.
Trojan.IRCBot, Trojan.Dropper.Agent, W32.Virut,
and Trojan.Crypt showed similar behavior. These samples tried to enter the IRC server with password.
Trojan.IRCBot, W32.Virut and Trojan.Crypt used port
555. Trojan.Dropper.Agent used port 976. Trojan.IRC
Bot sent “Password h4xg4ng”, “NICK [00|JPN|XP|339952]” and “User ID SP0-805 * 0 :M11MM0482LBFCJ”
to the server. The others sent similar information. We
guess that the password is used to enter the server and
NICK is infected host information. In addition, USER
ID was infected Windows user name. We guess thatmalware’s creator collects infected host information tocontrol. Furthermore, these samples sent ARP request
to the same segment network hosts. Receiving ARP reply from a host, these sample tried to connect to thehost using microsoft-ds. After these samples sending
ARP request X.X.X.254, these samples sent ARP request to the next segment. We guess that this is theinfection action.
e95f7 resolved a domain “www.google.com” and tried
to connect to the domain. Then, it resolved a domain “www.what...” and tried to connect to the domain. This domain was a website which showed client’s
IP address. In addition, this website showed client’s IP
address as a image. This sample sent HTTP request“GET / HTTP/1.0” to the website. However, the website only replied for “HTTP/1.1” request. We guessthat the website changed the speciﬁcation. In addition,
the sample sent “USER M11MM048-2LBFCJ n n :nservice” and “NICK P|000|JPN|XP-SP0|zkpregfscf|” to adomain “frayednd...” with port 7007. Furthermore, it
sent ARP request to same segment hosts which is similar to Trojan.IRCBot. We guess that this is the infection
action.
54932 and 8746e show same behavior. These samples
continued sending packets with ports 137 and 138 to
192.168.0.255. We guess that this is the infection action.
After analysis, we tried to connect to each corresponding servers with the same port. However, we could notconnect to servers.
4.2

Malware Analysus with TransParent Proxy

We did not analyze malware samples with transparent proxy since we could not connect to corresponding

servers. Hence, we tested the proxy using the wget command. A host tried to get fake.exe ﬁle, using wget withtransparent proxy, from our server. The host executed“wget h303.../fake.exe” command. Then, the host got
the fake.exe. We show the fake.exe below.
Content of fake.exe<html><body> HELLO!! </body> </html>

Although the host requested exe ﬁle, the proxy removed
http body.

5

Conclusion

We made the disconnected internet environment on
one computer using GINE and QEMU. Providing fake
DNS, HTTP, IRC and FTP servers, we could ﬁgure out
malaware behavior. This study is eﬀective for types of
malware that sends infected host information. There
are many possible improvements. We show the improvements below.
• Spam analysis mail attachmented ﬁle• Malware analysis with transparent HTTP proxy• Implementation of transparent proxy with otherprotocols
Acknowledgments. This study was supported by
the anti-Malware engineering WorkShop(MWS).

References[1] S. Miwa, D. Miyamoto, H. Hazeyama, D. Inoue,and Y. Kadobayashi, “Improving isolated sandbox
using fake dns server,” in Cyber Clean Center・
Information Processing Society of Japan, anti
Malware engineering WorkShop 2008（MWS2008),
http://www.iwsec.org/mws/2008/manuscript/
1019.pdf, Oct. 2008 (In Japanese with English
summary).
[2] G. Christian, F. C. Freiling, M. Kuhrer, and T. Holz,“Truman box: Improving dynamic malware analysis by emulating the internet,” in 13th International
Symposium, SSS 2011, Grenoble, France, Oct. 2011,
pp. 208–222.
[3] M. Yasuaki and K. Goto, “Design and implementation of malware analysis using network emulator GINE,” in Computer Security Symposium 2012
(CSS2012), Vol. 2012, No. 3, Oct. 2012 (In Japanesewith English summary), pp. 114–121.
[4] K. Goto, “Network emulator with virtual host andpacket diversion,” in Cyber Journals: Multidisciplinary Journals in Science and Technology, Journalof Selected Areas in Telecommunications (JSAT),
Vol. 3, No. 3, 2012, pp. 13–20.
[5] J. A. Morales, A. Al-Bataineh, S. Xu, and
R. Sandhu, “Analyzing and exploiting network behaviors of malware,” in Security and Privacy inCommunication Networks Lecture Notes of the Institute for Computer Sciences, Social Informatics andTelecommunications Engineering, Vol. 50, 2010, pp.
20–34.
[6] VA Linux Systems, “ftpd,” accessed Feb. 2013,
http://jftp.sourceforge.net/.
[7] anti-Malware
engineering
WorkShop,“Aboutmws,”
accessedFeb.
2013,
http://www.iwsec.org/mws/2009/en about.html.