Emulate SandBox and VMs to avoid malware infections

No ratings

Presented at GrrCon 2014 by

The use of virtualization software is widely known by malware researchers. They need a controlled environment so they can run the malware safely in order to analyze changes in the system, network traffic and the resources used. Although there are several virtualization tools and Sandbox, this paper only addresses Virtual Box and Cuckoo, one of the most popular tools to to analize malware. A large amount of current malware uses various anti-virtual-machine techniques in order to avoid detection by analysis. These techniques allow the malware to detect the virtual machine which will then execute a benign action or simply do nothing. Many of these techniques are based on finding specific files in the system or consulting some Windows registry keys. The purpose of this research is to study the characteristics of the Oracle Virtual Box virtualized operating system and try to replicate the configuration on a physical computer, in order to trick the malware into thinking it is in a virtual environment and thus not triggering its execution. To perform this work, we have created a python script that modifies the Windows registry, creates files in the system and download libraries to emulate a virtual environment. With this script it is possible to fool VM detection tools such as Pafish even real malware samples. I mean that, the most important think about this paper is that with this technique, you can avoid infections by unknown malware.