Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
This is a good starting point.
As you know: Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by running some checks to detect such environments before performing any malicious actions.
I'm looking for ways for a malware analyst to bypass these protections to overcome this anti-VM (anti-hypervisor) stuff?
There is no exact way to bypass them but when I have to deal with them, I first try to figure out all those places where anti techniques have been present in assembly code by generally looking at imports and api calls. Then the best way to bypass them is to patch them with some other instructions, so when you run the program there code doesn't get executed.
CXPInspectorwill give you a number of papers (from 5 years ago) that were made into a commercial product. The idea there was to provide introspection into hypervisor guests using shadow page tables (CPU feature!) and knowledge about the system running as guest. No artifacts need to be inside a sandbox created this way. The papers provide a good starting point for own projects.