The Impact of Network Configuration on Malware Behaviour

Malware poses a serious threat against the Internet and the users. One way to examine and understand the malware’s behaviour, with the purpose to detect and mitigate this issue, is to dynamically analyse them within a controlled and isolated environment, i.e. sandbox. Sandbox is a mechanism where suspicious programs and binaries are executed and monitored in isolation without the risk to spread to real and operational systems. However, the sandbox technology evolves also does the malware’s sophistication. For this purpose, the malware’s author deploy evasion techniques with the aim to keep the malware dormant under specific environmental factors and thus hinder the malware’s analysis. To this day, there has been no investigation on the impact of the network topology on the malware’s activity. To this direction, in our work, we utilize the Cuckoo Sandbox to study three different categories of malware, e.g. Backdoor, Net-worm and Trojan in four different network configurations. We examine different features of the malware’s behaviour to showcase the effect of each configuration on the reported activated features. We observe that allowing Internet provides the best results in terms of threat score, which is expected given that the malware have full connectivity to perform their intended actions unrestricted. On the other hand, by limiting the Internet connection and allow only DNS resolutions for specific domains in an allow-list, generally activates the highest number of signatures of the volatility category, while the configuration with Internet triggers all possible signature categories.