Detecting Hostname, Username

Created the Monday 11 March 2019. Updated 6 months, 2 weeks ago.

Most sandbox are using name like Sandbox, Cuckoo, Maltest, Malware, malsand, ClonePC.... All this hostname can provide the information to the malware. The username can also be checked by malware.

Technique Identifier

U1311

Code Snippets

#include <iostream>
#include <windows.h>

int WINAPI WinMain ( HINSTANCE, HINSTANCE, LPSTR, int )
{
  char  ComputerName [MAX_COMPUTERNAME_LENGTH + 1];
  DWORD cbComputerName = sizeof ( ComputerName );

  if ( GetComputerName ( ComputerName, &cbComputerName ))
     { 
         MessageBox ( NULL, ComputerName, "Computer Name:", MB_OK | MB_ICONINFORMATION ); 
     } 
}

Detection Rules

                                    rule:
  meta:
    name: check for sandbox username
    namespace: anti-analysis/anti-vm/vm-detection
    author: "@_re_fox"
    scope: function
    mbc:
      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]
    examples:
      - ccbf7cba35bab56563c0fbe4237fdc41:0x402B90
    references:
      - https://github.com/LloydLabs/wsb-detect
  features:
    - and:
      - api: GetUserName
      - or:
        - string: /MALTEST/i
          description: Betabot Username Check
        - string: /TEQUILABOOMBOOM/i
          description: VirusTotal Sandbox
        - string: /SANDBOX/i
          description: Gookit Username Check
        - string: /^VIRUS/i
          description: Satan Username Check
        - string: /MALWARE/i
          description: Betabot Username Check
        - string: /SAND\sBOX/i
          description: Betabot Username Check
        - string: /Test\sUser/i
          description: Betabot Username Check
        - string: /CurrentUser/i
          description: Gookit Username Check
        - string: /7SILVIA/i
          description: Gookit Username Check
        - string: /FORTINET/i
          description: Shifu Username Check
        - string: /John\sDoe/i
          description: Emotet Username Check
        - string: /Emily/i
          description: Trickbot Downloader Username Check
        - string: /HANSPETER\-PC/i
          description: Trickbot Downloader Username Check
        - string: /HAPUBWS/i
          description: Trickbot Downloader Username Check
        - string: /Hong\sLee/i
          description: Trickbot Downloader Username Check
        - string: /IT\-ADMIN/i
          description: Trickbot Downloader Username Check
        - string: /JOHN\-PC/i
          description: Trickbot Downloader Username Check
        - string: /Johnson/i
          description: Trickbot Downloader Username Check
        - string: /Miller/i
          description: Trickbot Downloader Username Check
        - string: /MUELLER\-PC/i
          description: Trickbot Downloader Username Check
        - string: /Peter\sWilson/i
          description: Trickbot Downloader Username Check
        - string: /SystemIT/i
          description: Trickbot Downloader Username Check
        - string: /Timmy/i
          description: Trickbot Downloader Username Check
        - string: /WIN7\-TRAPS/i
          description: Trickbot Downloader Username Check
        - string: /WDAGUtilityAccount/i
          description: Windows Defender Application Guard

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

https://www.first.org/resources/papers/conf2017/Countering-Innovative-Sandbox-Evasion-Techniques-Used-by-Malware.pdf