I Interviewed an Executable. It Had Notes.

A developer recently conducted an experimental study by creating a Rust-based executable designed to report on the environments where it was executed. By submitting the binary to VirusTotal, the author collected telemetry data, including OS versions, hardware specifications, and process information, via DNS heartbeats and HTTPS dossiers. The experiment aimed to reverse the traditional malware analysis workflow, where a sandbox usually observes a program. Instead, the program observed the sandbox. The collected data revealed interesting patterns, such as how different analysis environments renamed the file or handled network requests. The author visualized the findings in a project called WAYPOINT, which maps the telemetry data to provide insights into how various services interact with unknown binaries. While the study provides a unique look at environment fingerprinting, the author notes that the results are based on heuristics and do not definitively identify specific sandbox operators or infrastructure.