# Investigating Anti-Evasion Malware Triggers Using Automated Sandbox Reconfiguration Techniques
## 7 Discussion  
We present a study of assessing anti-evasive malware triggers, using a systematic testing and reconfiguration environment that we refer to as MORRIGU. This enables a streamlined approach for preparing a reusable virtualised sandbox environment that allows for different evasive properties to be studied, deploying malicious software samples from a repository and capturing the resulting behaviours that can be examined using a visual analytics dashboard. From an initial set of 251 malware samples that were gathered based on the CIS top 10 malware threats between August 2019 and January 2020, we use MORRIGU to study the nature of evasive malware in the currently trending threats. We found that at least 40 (16% of our sample set) exhibit evasive methods, such that 53% of samples would execute and reveal the malicious behaviour in any given environment (i.e., a fresh install of the Windows 10 environment), whereas when also factoring in the anti-evasion checks in MORRIGU, we observe that this increases to 69% of samples. While this percentage increase may seem relatively low, it is important to appreciate the true nature of this finding--this represents 40 malware samples that if examined under \"normal\" testing conditions could be deemed as benign software, and yet, if allowed into a production environment, could cause serious damage. This work is designed to provoke further investigation into the nature of evasive malware and contributes software tools to aid the community in doing so. In our dataset, 78 samples did not exhibit any malicious activity. It is important to recognise here that these samples could well be evasive, whereby they may only perform the intended malicious function under a different set of environment conditions. While it is impossible to test every possible environment configuration, MORRIGU enables efficient testing of a larger number of possible configurations; therefore, improving the likelihood of identifying a trigger for deployment. However, another significant challenge in malware research is that samples could be obsolete and associated with older software platforms or applications. Our samples were gathered between August 2019 and January 2020, which could be designed to exploit vulnerabilities associated with software versions particular to that time period, which could potentially be redundant already. This is yet why identifying a subset of evasive malware, and more specifically, \begin{table}
\begin{tabular}{c c c} \hline \hline
**Malware Sample** & **Cuckoo Score (Win10)** & **Cuckoo Score (Win7)** \\ \hline
**Lokibot\_95 df (Infostealer)** & 0.8 & 6.6 \\
**Neutrino\_4929 (Bot Net)** & 0.6 & 0.6 \\
**Neutrino\_4975 (Bot Net)** & 0.6 & 0.6 \\
**Nymaim\_c003 (Ransomware / Downloader)** & 1.2 & 0.8 \\
**Qakbot\_2f63 (Infostealer)** & 0.8 & 14.0 \\
**Qakbot\_8279 (Infostealer)** & 0.4 & 13.6 (12.6) \\
**QuantLoader\_acca (Downloader)** & 0.2 & 1.6 \\
**Panda\_244f (Banking Trojan)** & 0.4 & 5.8 \\
**Panda\_b455 (Banking Trojan)** & 6.0 & 5.4 \\
**Panda\_ca8b (Banking Trojan)** & 6.4 & 5.8 \\
**Pushdo\_cd63 (Bot Net)** & 0.8 & 2.2 (2.8) \\
**Strictor\_5e9c (Downloader)** & 0.2 & 1.8 (1.2) \\
**Tinba\_3132 (Banking Trojan)** & 0.8 & 6.8 \\
**Tinba\_9120 (Banking Trojan)** & 0.0 & 5.6 \\
**Tinba\_b377 (Banking Trojan)** & 0.0 & 2.2 \\
**Tinba\_ba58 (Banking Trojan)** & 1.0 & 7.0 \\
**Ursnif\_0e82 (Infostealer)** & 0.6 & 1.8 (1.0) \\
**Ursnif\_393a (Infostealer)** & 2.8 (2.0) & 2.8 (2.0) \\
**Ursnif\_ad1d (Infostealer)** & 0.6 & 1.8 (1.0) \\
**Ursnif\_ee9f (Infostealer)** & 0.6 & 1.8 (1.0) \\
**WannaCry\_410f (Ransomware)** & 0.4 & 4.2 (5.0) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: \(Cont.\)offering tools to identify future evasive malware, is both important to our community and remains a continual challenge. Our research shows how malware families may depend on a particular set of evasion strategies.