SNDBOX

Designed by researchers for researchers, the world’s first AI malware research platform, offering never-seen-before malware analysis visibility.

[SNDBOX @SNDBOXCOM]

Introducing UltraFast SNDBOX! the fastest most scalable solution in the industry, providing accurate verdicts powered by deep learning in under 60 seconds of dynamic analysis - for millions of files.
Detect 0-day and evasive malware attacks fast and accurately.

[SNDBOX @SNDBOXCOM]

We have now completed our integration with IBM Security (#IBMResilient) to Fight Evasive Malware Innovation with AI Innovation.

https://t.co/ygZ1cdfEM0

#IBM #Resilient #IBMSecurity #AI #ArtificialIntelligence #Malware

[SNDBOX @SNDBOXCOM]

@superMi11818336 @Pr3R00T Hey there Mike, could you please DM us the problems you encountered, and I will do my best to help out.

[SNDBOX @SNDBOXCOM]

SNDBOX += VirusTotal;
We are excited to join VirusTotal's MultiSandbox.
All @virustotal files analyses are available for all of our registered users at https://t.co/jHfNEbN9s9

[VirusTotal @virustotal]

VirusTotal MultiSandbox += SNDBOX https://t.co/XJC1n41hru

[SNDBOX @SNDBOXCOM]

Our CEO Dr. Ran Dubin (@DubinRan) presenting SNDBOX at the @IBM AlphaZone Demo day. #IBM #AlphaZone

[SNDBOX @SNDBOXCOM]

@marcelmalware So is that as David said? Perhaps some human behavior missing?

[SNDBOX @SNDBOXCOM]

New type of attack on #OLE (Office) files to avoid AV detection.
Malware Doesn't execute anything, leaves a #GenericPersistence mechanism to execute after machine restart.

21 \ 61 on VirusTotal

IOCS:
solsin[.]top/w1
eb49ee744d8a05c877681c68da251720

https://t.co/7KeQx4dV3e

[SNDBOX @SNDBOXCOM]

@Ledtech3 Hmm thats interesting! We'll have a deeper look

[SNDBOX @SNDBOXCOM]

@Ledtech3 It doesnt detect the sandbox, it tries to avoid being detected by only dropping a file that will execute after machine restart, and doesn't execute the file by it self

[SNDBOX @SNDBOXCOM]

In May we analyzed over 980K files which are easily accessible and searchable for all registered users on our public feed: https://t.co/V5eHetCGWB

[SNDBOX @SNDBOXCOM]

1/56 Detection on #VirusTotal, #PowerShell #Downloader #WMI

https://t.co/AqxIKjDyOi

[SNDBOX @SNDBOXCOM]

Interesting behavior of winword.exe -> svchost.exe -> wmi -> powershell
Behavior visibility obtained by monitoring #RPC calls on the operating system

[SNDBOX @SNDBOXCOM]

Searching the malicious CNC IP Address on SNDBOX, yields more results of similar attacks

92[.]38[.]135[.]134
https://t.co/vIYn1DHV4x

[SNDBOX @SNDBOXCOM]

Recently uploaded, only 3/61 hits on VT, fake "Protected document" while executing malicious #MSI payload on the machine from remote server.
https://t.co/RNH70Kq7at

[PR3R00T @Pr3R00T]

TPOT Honeypot platforms #tpotce can upload samples captured from the #adbhoney and #Dionaea Honeypots to the SNDBOX Platform @SNDBOXCOM with the SNDBOX-MultiFile-Uploader. Check it out at:
https://t.co/kxTbk8FiuF

[SNDBOX @SNDBOXCOM]

@Pr3R00T Nice job!

[PR3R00T @Pr3R00T]

Created a Light Python3 wrapper for the SNDBOX Rest API
@SNDBOXCOM the code will upload supported files, provide metadata details and search the SNDBOX database returning the raw response. Check it out at: https://t.co/NQwiWbUQju

[SNDBOX @SNDBOXCOM]

Fresh sample with 0\57 detection on VT, doing #ProcessDoppelganging

https://t.co/sw7Zsm1U8F

MD5: 96ac65ebea9dd5df22a523a2ffda15d2
Payload url: hXXp://alabamaok0515[.]https://t.co/Lvwyvhzf9r
IP: 88[.]99[.]13[.]69

[SNDBOX @SNDBOXCOM]

New static feature: we have added a DOCUMENT PREVIEW tab, preview to document files & #OCR.
This opens many new feature possibilities to (A) enhance our detection, (B) #similarity search between known attacks, and (C) more information for researchers

https://t.co/u5a6pO7cbS