65

The title mentions "sandbox" but VMWare or QEMU is usually not called that, so the question seems to be more about "how do I analyze it without a danger of infection?" There are three broad categories of tools and approaches you could take here. 1. User-mode sandboxes A user-mode sandbox basically runs the sample being investigated but intercepts all or ...


22

Bochs if you don't need speed but lots of flexibility. You can use Bochs with GDB. Qemu if you need more speed and less flexibility (it does dynamic translation so you gain bit of speed but lose the acutal sequence of the instructions) possibly a bit less safe than bochs. Its similar to Vmware and virtualbox actually derives from it. You can use GDB with ...


15

Gilles provided some great links and I want to discuss the use a virtual machines for malware analysis a bit more. While a VM breakout certainly is a possibility, I have yet to come across such a case or even heard about one and I assume this would make some buzz should someone find one. To be safe, simply run your VM software on an isolated computer and ...


15

the list could be endless, so I'll keep it short: virtualized environment artifacts: registry keys, hard disk name, network card address, specific drivers,... environment differences: no mouse, internet connection, sound card,... execution difference: detection of block translation (create another thread and apply statistics on IP), different system ...


15

There are a multitude of ways to detect virtual machines/emulators, mostly following the pattern of identifying an imperfection in the simulation and then testing for it. At the simplest end, common virtualization toolkits plaster their name over all kinds of system drivers and devices. Simply looking at the name of network connections or their MAC address ...


13

In fact, they do not claim at all to evade from any virtual machine. But, by using the MMU fault handler mechanism to perform computation, they expect to render the encapsulation of their program unpractical. Indeed, the point is to find unexpected primitives to perform computation, doing so only a few virtual machine environments will be able handle such ...


12

The malware can propagate from the VM to the host in several circumstances: If there's a bug in the VM software. That's not very common, but it's possible. If there's a bug in the host OS. A bug that specifically allows malware to break out of a VM is unlikely but again possible. If there's a bug in the processor. That's even more unlikely but still not ...


11

Here are some tricks for detecting VM's: VirtualBox http://pastebin.com/RU6A2UuB (9 different methods, registry, dropped VBOX dlls, pipe names etc) http://pastebin.com/xhFABpPL (Machine provider name) http://pastebin.com/v8LnMiZs (Innotek trick) http://pastebin.com/fPY4MiYq (Bios Brand and Bios Version) http://pastebin.com/Geggzp4G (Bios Brand and Bios ...


8

Regarding question #1, no IDA does not handle obfuscated binaries. You might be interested by the Virtual Deofbuscator talk Jason Raber gave at Blackhat last year, he also released an IDA plugin and the source code is available. Slides : https://media.blackhat.com/us-13/US-13-Raber-Virtual-Deobfuscator-A-DARPA-Cyber-Fast-Track-Funded-Effort-Slides.pdf ...


7

Literally, for a first look on malware, you won't need anything special locally installed. There are enough online sandboxes you may use: virustotal.com have their sandbox implemented using Cuckoo Sandbox. When you apply new sample, it automatically executed as part of analysis. After about 10-15 mins you can see the result in "Behavioural information" ...


6

It has been a while since I've used Virtual PC, but I remember the instructions in this guide worked well: http://silverstr.ufies.org/lotr0/windbg-vmware.html However, Virtual PC is extremely outdated (7 years old) and it's much easier nowadays to do VM kernel debugging with VirtualKD along with VMware or VirtualBox.


6

For learning purposes, I would recommend you the following Github projects to start with: Paranoid Fish by a0rtega https://github.com/a0rtega/pafish Al-Khaser v0.60 by Noteworthy https://github.com/LordNoteworthy/al-khaser or Colection by AlicanAkyol https://github.com/AlicanAkyol/sems Grab one you like, compile and analyze. In case you look for in ...


5

you can try breaking on driver load instead on just the entry: sxe ld drv.sys This will stop windbg when the image gets loaded, so you'll be able to set breakpoints using raw addresses if all else fails.


5

There were a lot of saying in replays, but I'd like to stress on some answers from the practical point of view: network connection - a while ago I would agree that simply disconnecting the vm from the network will solve the problem of spreading through the network. Today, there are more and more malwares that will work only when the connection to CnC has ...


5

I wrote a test program a while go (in Delphi). The following two functions detect VMware and HyperV // VMware detection as described by Elias Bachaalany function IsInsideVMware: Boolean; begin Result := True; try asm push edx; push ecx; push ebx; mov eax, 'VMXh'; mov ebx, 0; mov ecx, 10; mov edx, 'VX'; ...


5

There's a lot to Google on the topic, so take some time to do that and learn about what the *.dcr format is. A great initial point of reference for you is this post on the ZenHAX forum, where a script or two have been created for use with their program, QuickBMS. That won't teach you how to reverse the format, but if you spend some time reading what QuickBMS ...


4

You can find common tricks in cuckoo sandbox repository.


4

In addons on the answers post before, cuckoosandbox implements few yara rules for vm detection: https://github.com/cuckoobox/cuckoo/blob/1884b5579ff8e053b3d4a8523a5da576eee43552/data/yara/binaries/vmdetect.yar


4

if youre using VMWare I suggest using a host only connection. Typically when you create a VM it will use NAT or bridged, sharing the host computers IP and/or network adapter. Using Host-Only lets the VM only be locally connected to that particular adapter with no internet connectivity(It's assigned its own local IP and uses its own Gateway) Typically when ...


4

If the VM software has a bug a malware can also spread out of the VM and infect the host computer. There is also the possibility that the underlying processor (if you are using hardware virtualization) has a bug which lets the malware escape the VM. If you have a network connection it is possible that the malware can spread over the network. So to prevent ...


4

i'm the developer of r2vmi, and found your topic by googling my own project. I have been working on an improved version by reimplementing a GDB stub: https://github.com/Wenzel/pyvmidbg The README contains a demo if you want a quick look. I'm able to debug a Windows XP VMs, both kernel and userland, given you have the right symbols, with radare2. I ...


3

VMware exposes a GDB stub specifically for this purpose. Using this stub, one can connect GDB (or any GDB front-end) to manipulate the guest OS, as if it were a process. VMware - OSDev Wiki Debugging Windows kernel under VMWare using IDA's GDB debugger - HexRays


3

Use the latest and greatest version of VMWare. Monitor your real system. :) Why? well I've seen malware that 'breaks' out Vmware. How? Ring -1 exploitation. It's not something you'll commonly seen. But it can happen, will it with your sample unlikely but, it might. So, monitor your own system (ProcMon). Don't install VMware tools (easier detected by the ...


3

Here is a collection of anti-sandbox/vm/debugger techniques implemented in a open source program which will give you a clear idea how to detect virtualization: https://github.com/LordNoteworthy/al-khaser. Here are the list of supported techniques: Anti-debugging attacks IsDebuggerPresent CheckRemoteDebuggerPresent Process Environement Block (BeingDebugged)...


3

Just as a kind of related note, but side-stepping the actual question a bit. There was a presentation at the VB conference last year (2013) in Berlin, about a KVM-based modified hypervisor. It is called CXPInspector and the presentation they gave (the first one in the tech stream) can be found here. Here's the corresponding thesis/dissertation (237 pages) ...


3

that is normal for virtual pc to say debugee not connected as it has not connectedto the target yet it has just established a transport press ctrl+break once to connect and press g to resume running. As Jason suggested get the free vmware player and configure virtualkd for a much faster debugging com port is too slow for many things especially conditinal ...


3

This is a step-by-step approach, excluding the actual host system installation, VMware setup and Virtual Machine creation, since these are rudimentary steps and anyone willing to perform kernel debugging should be capable doing. The approach is split into three parts - the VM hardware settings, MS Windows configuration, and establishing a debugging session. ...


3

You should try VirtualKD which uses a fast VM-specific mechanism to communicate with the debugger instead of slow serial port emulation. Another option could be Ethernet or USB-based debugging but I'm not sure how to set it up with VMs...


3

I want to know how to test malware files with out using virtual environment. Check out the answers in the following, similar, question: Analysing malware in a real environment (non-virtual environment) TL;DR: Check out Faronics Depp Freeze for example. I recommend reading the answers as a whole. In addition, read the answers to the following question on ...


3

IDA 7.0 is x64 application, i.e. both ida.exe and ida64.exe are built for x64, despite the naming. So you won't be able to run 7.0 on x86 at all. Use IDA versions previous to 7.0.


Only top voted, non community-wiki answers of a minimum length are eligible