# Investigating Anti-Evasion Malware Triggers Using Automated Sandbox Reconfiguration Techniques
## 5 Results
### Anti-Evasion Results Based on Malware Families
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & \multicolumn{3}{c}{**Configuration Options**} \\ \multirow{2}{*}{**Malware Sample**} & **Guest** & **Time** & **Reverse** & **Registry** & **Common** \\  & **Additions** & **Jump** & **Turing** & **Edit** & **Artefacts** \\  & **Uninstalled** & & **Test** & & **Creation** \\ \hline \hline
**Adposhel\_60 de (Adware)** & & & & & \(\checkmark\) & \(\checkmark\) \\
**Andromeda\_240a (Downloader)** & \(\checkmark\) & & & & \\
**Andromeda\_928a (Downloader)** & \(\checkmark\) & & & & \\
**Andromeda\_eale (Downloader)** & \(\checkmark\) & & & & \\
**Azorult\_cde2 (Infostealer)** & \(\checkmark\) & & & & \\
**Bayrob\_8972 (Infostealer)** & \(\checkmark\) & & & & \\
**Bayrob\_ab9b (Infostealer)** & \(\checkmark\) & & & & \\
**Bayrob\_b12e (Infostealer)** & \(\checkmark\) & & & & \\
**Bayrob\_b67e (Infostealer)** & \(\checkmark\) & & & & \\
**BitCoinMiner\_8554 (Cryptocurrency Miner)** & \(\checkmark\) & & & & \\
**Blocker\_2c1c (Ransomware)** & \(\checkmark\) & & & & \\
**Blocker\_7 fe1 (Ransomware)** & & & \(\checkmark\) & & \\
**Dridex\_58 fb (Banking Trojan)** & & & \(\checkmark\) & \\
**Dridex\_d684 (Banking Trojan)** & & & \(\checkmark\) & & \\
**Dridex\_f236 (Banking Trojan)** & & & \(\checkmark\) & & \\
**Gamarue\_f7d2 (Downloader)** & \(\checkmark\) & & & & \\
**Gozi\_3130 (DGA)** & & & & \(\checkmark\) & \\
**Gozi\_8e8b (DGA)** & & & \(\checkmark\) & & \\
**IcedID\_04 fb (Banking Trojan)** & & & \(\checkmark\) & \(\checkmark\) & \\
**Lokibot\_95 df (Infostealer)** & & \(\checkmark\) & \(\checkmark\) & & \\
**Neutrino\_4929 (Bot Net)** & & & & \(\checkmark\) & \\
**Neutrino\_4975 (Bot Net)** & & & \(\checkmark\) & & \\
**Nymaim\_c003 (Ransomware / Downloader)** & \(\checkmark\) & & & \\
**Qakbot\_2f63 (Infostealer)** & \(\checkmark\) & & & \\
**Qakbot\_8279 (Infostealer)** & \(\checkmark\) & & & \\
**QuantLoader\_acca (Downloader)** & & & \(\checkmark\) & & \\
**Panda\_244f (Banking Trojan)** & & & \(\checkmark\) & & \\
**Panda\_b455 (Banking Trojan)** & & & \(\checkmark\) & & \\
**Panda\_cab** (Banking Trojan)** & & & \(\checkmark\) & & \\
**Pushdo\_cd63 (Bot Net)** & \(\checkmark\) & & \(\checkmark\) & & \\
**Strictor\_5e9c (Downloader)** & & & & \(\checkmark\) & \\
**Tinba\_3132 (Banking Trojan)** & & & & \(\checkmark\) & \\
**Tinba\_9120 (Banking Trojan)** & & & \(\checkmark\) & & \\
**Tinba\_b377 (Banking Trojan)** & & & & \(\checkmark\) & \\
**Tinba\_b58 (Banking Trojan)** & & & & & \(\checkmark\) \\
**Ursnif\_0e82 (Infostealer)** & & & \(\checkmark\) & & \\
**Ursnif\_393a (Infostealer)** & & & \(\checkmark\) & & \\
**Ursnif\_ad1d (Infostealer)** & & & \(\checkmark\) & & \\
**Ursnif\_ee9f (Infostealer)** & & & \(\checkmark\) & & \\
**WannaCry\_410f (Ransomware)** & & & & \(\checkmark\) & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Results from 40 evasive malware samples to show the minimum anti-evasion configuration required to trigger a malicious response. Other findings from our study indicate that there was correlation between network activity and malware families. For example, the network behaviour of most ransomware samples during testing was readily identifiable, e.g., one sample of WannaCry (Ransomware) attempted to connect to over 10,000 IPs within 10 min. However, this was not the case for all samples which used hardcoded IPs, as one sample of Dridex (Banking Trojan) connected to only two malicious IPs, spread out over 4 min, with the largest amount of data (13k bytes) being sent in less than 6 s. The type of malware and risk appetite, therefore, seems to be key factors in the network activity, specifically when using hardcoded IPs. A Banking Trojan that attempts to exfiltrate data without being noticed is clearly more concerned with remaining discrete in its use of hardcoded IPs, compared to a Ransomware attack that would be highly visible on a machine or network.