|
|
One common technique used by malware researchers is to analyze a sample using virtual machines.
In recent years, malware developers have created “checks” against environments and common malware-analysis tools. If the malware detects a security application, the former will not execute or will execute a deceptive function.
I recently came across some common checks for:
Last week, I analyzed a sample that had two of these checks. During my behavioral analysis on a VMware machine, the malware would run fine but then didn’t perform any other activity. After some reverse-engineering of the sample, I came across the following strings:
SELECT * FROM Win32_VideoController
winmgmts:
ExecQuery
Description
VM Additions S3 Trio32/64
VirtualBox Graphics Adapter
VMware SVGA II
This simple check tells the malware whether the machine is running in a virtual environment.
When querying the system for the video controller, it checked the results against these virtual machines:
The final check was for the presence of the product Sandboxie. The malware verified the result of the function:
GetModuleHandle(“SbieDll.dll”)
If it received a “true” as the result, it would perform differently than after a “false” result.
These checks may not be new tactics, but you should know that we are constantly investigating the possibility of malware authors using new techniques to try to thwart our analysis.
|
|
Tags: bueno, malware, Malware research, pedro bueno
If these techniques become more common for malware to fail to run in a virtual environment, is it possible to simulate these checks on a real physical computer? This would provide another layer of security until virus definitions could be released.
Pedro,
Did you see Atif Mushtaq’s analysis from yesterday?
http://blog.fireeye.com/research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
I still say that the easiest way to stop automated malware analysis is to simply wait for a user action before doing something malicious.
Detecting whether it’s being debugged/disassembled in a VM is rather useless, as it just sets off warning signs.
Submit your own comments / message for this post