1

This is a good starting point.

As you know: Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by running some checks to detect such environments before performing any malicious actions.

I'm looking for ways for a malware analyst to bypass these protections to overcome this anti-VM (anti-hypervisor) stuff?

  • 1
    there's no generic bypass solution AFAIK, so you'll have to learn how this exact malware detects the VM, and implement your own bypass. – Anton Kukoba May 7 '18 at 7:16
  • 1
    This is a bit of a broad question, but it may attract some high quality answers nevertheless. There are a myriad of anti-hypervisor and anti-anti-hypervisor techniques. Example: a search for CXPInspector will give you a number of papers (from 5 years ago) that were made into a commercial product. The idea there was to provide introspection into hypervisor guests using shadow page tables (CPU feature!) and knowledge about the system running as guest. No artifacts need to be inside a sandbox created this way. The papers provide a good starting point for own projects. – 0xC0000022L Jul 12 '18 at 7:41
2

There is no exact way to bypass them but when I have to deal with them, I first try to figure out all those places where anti techniques have been present in assembly code by generally looking at imports and api calls. Then the best way to bypass them is to patch them with some other instructions, so when you run the program there code doesn't get executed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.