Nasty Dyre malware bests white hat sandboxes Seculert CTO Aviv Raff says a nasty piece of malware linked to widespread destruction and bank account plundering has become more dangerous with the ability to evade popular sandboxes. Raff says the Dyre malware ducks popular sandbox tools by detecting the number of cores in use. The known but effective and previously unused …
Although I have nothing particular against Seculert.... if you've seen their presentations and marketing material, they effectively advocate that virtual sandboxing of malware (a la FireEye) is not effective and that their surveillance of your egress network flow is a better way to detect malware. This is just a way to drum up their product.
Being able to detect that one is operating in a VM is not new to malware.
Red Pill, developed by Joanna Rutkowska, is an example of a technique to detect that one is inside a VMWare and MS VirtualPC virtual machines. More generic tests, such as counting the time taken to execute two instructions, can also be used to tell software it's inside a VM.
A fair amount of malware checks to see if it is in a VM, and stops if it is. It's a technique to make it more difficult for security researchers to study the malware.
Amateurs. The proper thing for malware to do after detecting it's being sandboxed/virtualized/analyzed is, of course, not to exit immediately but rather go on and do completely innocent things. Early exit kinda means you have something to hide, and sticks out like a sore thumb in analysis logs.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
