Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1037950" data-attributes="member: 99014">If they are focused on testing executables, many, if not all contain logics that will inspect different parts of the OS and hardware, and will suspend delivery of the real malicious payload.These logics include (here also a book can be written), but are not limited to:<ul>
<li data-xf-list-type="ul">Checking recently opened documents, browser history, browser tabs.</li>
<li data-xf-list-type="ul">Checking programs list to determine is it minimal, clean installation or is it a real production system.</li>
<li data-xf-list-type="ul">Checking system parameters such as firmware name, CPU temperature, RAM and free disk space size, and others.</li>
<li data-xf-list-type="ul">Using listeners to determine is there keyboard/mouse activity. You’ve just opened the malicious sample, you should still be on the computer and using it.</li>
<li data-xf-list-type="ul">Performing malicious actions when document is scrolled to the last page.</li>
<li data-xf-list-type="ul">Requiring buttons to be clicked.</li>
<li data-xf-list-type="ul">Checking debug privileges.</li>
<li data-xf-list-type="ul">Playing with time, delaying execution, getting the system installation time/date and others.</li>
</ul>And many, many, many more, most of which can somehow be controlled but of course, malware authors are creative. There are many projects online that have researched VM/emulation (which also uses VM + logics to speed up the execution so more can be observed). Many of them (still not all) are discussed here:[URL unfurl=&quot;true&quot;]https://evasions.checkpoint.com/[/URL]I haven’t seen more comprehensive guide on how to control evasion of VM than this one.</blockquote>

[QUOTE="Trident, post: 1037950, member: 99014"] If they are focused on testing executables, many, if not all contain logics that will inspect different parts of the OS and hardware, and will suspend delivery of the real malicious payload. These logics include (here also a book can be written), but are not limited to: [LIST] [*]Checking recently opened documents, browser history, browser tabs. [*]Checking programs list to determine is it minimal, clean installation or is it a real production system. [*]Checking system parameters such as firmware name, CPU temperature, RAM and free disk space size, and others. [*]Using listeners to determine is there keyboard/mouse activity. You’ve just opened the malicious sample, you should still be on the computer and using it. [*]Performing malicious actions when document is scrolled to the last page. [*]Requiring buttons to be clicked. [*]Checking debug privileges. [*]Playing with time, delaying execution, getting the system installation time/date and others. [/LIST] And many, many, many more, most of which can somehow be controlled but of course, malware authors are creative. There are many projects online that have researched VM/emulation (which also uses VM + logics to speed up the execution so more can be observed). Many of them (still not all) are discussed here: [URL unfurl="true"]https://evasions.checkpoint.com/[/URL] I haven’t seen more comprehensive guide on how to control evasion of VM than this one. [/QUOTE]

Verification