Malware Sandbox Analysis Lab

Sample 1 — AgentTesla (VT majority label: FormBook)

PE header carries a deliberately fake compile timestamp of 1 Feb 2049 — an anti-forensics trick. Metadata spoofed as Company: Audacity. Section entropy 7.76/8.0 confirms packing. capa flagged anti-analysis strings and .NET resource-hidden payload prep.

The AgentTesla-vs-FormBook conflict got resolved with network evidence, not guessing: crowdsourced IDS rules matched are literally named "ET MALWARE Agent Tesla CnC Exfil via TCP" and "...AgentTesla Exfil via FTP." The sandbox also caught it opening FTP client configs and Chrome/Brave/Amigo profile folders — a textbook credential-harvesting sweep.

Beyond third-party sandboxes: this one was also self-run inside the lab's own isolated Windows10-Victim VM with Process Monitor capturing live — a real, self-observed .NET CLR bootstrap sequence, not a summary of someone else's report.

Sample 2 — RedLineStealer

The binary leaks its own build path in an embedded PDB reference under a randomly-named temp folder — consistent with RedLine's known stealer-as-a-service builder model. Disguised as CNCToolpathSimulator, a real category of legitimate CNC machining software.

Before exfiltrating, the sample checks the infected host's public IP via api.ip.sb and ipinfo.io, then POSTs stolen data to its real C2. Three of four sandboxes explicitly labelled it STEALER/MALWARE outright. Left running longer under Process Monitor, it produced a sustained TCP reconnect/disconnect beacon loop to the same C2 prefix already found via VirusTotal.

Sample 3 — njRAT / Bladabindi

Unlike the other samples, this one is not packed (entropy 5.62/8.0) — its full string table is readable directly, and it contains a hardcoded checklist of analysis tools it looks for before running: procexp, Sandboxie, Wireshark, Process Hacker, and — notably — VBoxService, the exact kind of VM this lab uses. Also present: real keylogging APIs, screen/webcam capture, a self-installed firewall exception, and the classic self-delete pattern.

Getting it to self-run required temporarily adding NAT to install a missing .NET Framework dependency via Windows Update — then removing it again to fully restore isolation before running the sample. A real, live Windows Defender detection fired mid-capture: Behavior:Win32/Bladabindi.gen.

Sample 4 — LokiBot delivery document (submitted as "officedocuments.doc")

The file extension lied: file and exiftool both identified this as plain RTF, not an OLE2 Word document. It opens with obfuscation padding that breaks AV signatures while Word's lenient RTF parser still opens and runs it normally. VirusTotal's community tags confirm the exploit chain directly: CVE-2017-11882 and CVE-2018-0798 — both Microsoft Equation Editor memory-corruption vulnerabilities, among the most exploited Office RCEs in history.

Sample 5 — AsyncRAT (VT sandbox signature: XWorm) — the headline result of this whole set

Submitted as a "Purchase Order" phishing lure (.vbs, 1.26 MB, 10,965 lines). Out of those 10,965 lines, static analysis found exactly one line of real logic — everything else is thousands of dead string-concatenation statements with junk dictionary-word variable names, existing purely to bloat the file past AV size/complexity thresholds. That's the direct, concrete reason the static detection ratio is only 5/61 despite the sample being unambiguously malicious the moment it actually runs.

Once detonated, the picture flips completely: Process Injection, credential dumping, and on-the-fly .NET compilation via csc.exe all appear. Network signature: "MALWARE-CNC Win.Infostealer.XWorm variant communication" — XWorm is a documented public fork of the leaked AsyncRAT source, which is exactly why two different vendor labels point at the same family tree.