Comments on The Dead Giveaways of VM-Aware Malware

sneino commented on 'The Dead Giveaways of VM-Aware Malware '

2011-02-27T08:09:25Z

this is good for older threats. the next wave of threats will be far more sophisticated. Targeted attacks/apts currently use far more complex techniques for evasion, such as opcode and api emulation weaknesses in sandbox/VMM/emulators. These are very difficult to detect, and some infeasible to notice without manual analysis. Additionally, zero day vulnerabilities are being used to evade. tools. Imagine running IDA or IDA w/ Hexrays and during disassembly compromising your system... imagine the box you use to sandbox and protect your network being compromised via zero day and sandbox escape, now you have a new threat channel, and its even more covert than a standard attack against an end node.

Roger commented on 'The Dead Giveaways of VM-Aware Malware '

2011-01-28T18:24:48Z

Many of these Anti-detection methods are indeed very old, there's is really nothing new about any of these, and the ProductId detection for Anubis is useless aswell, as it have plenty of different ones (Try it yourself, upload a sample that printf()'s the ProductId and upload it a few times, you will see that Anubis randomizes the ProductId

Other sandboxes probably does this aswell.

Either way none of this is a new concept and my guess is that it is a RAT or similar (Like Bifrost) that have been coded by script kiddies.

Is the exe made in VB or .NET by any chance?

James W commented on 'The Dead Giveaways of VM-Aware Malware '

2011-01-28T07:26:13Z

Great article as always, Atif.

Nikolay commented on 'The Dead Giveaways of VM-Aware Malware '

2011-01-28T07:03:12Z

Some of these tricks does not work already. They worked few years ago.

Atif Mushtaq commented on 'The Dead Giveaways of VM-Aware Malware '

2011-01-28T06:06:58Z

I am surprised that top malware list given by FireEye and Microsoft and thousands of ThreatExpert reports links are not enough for you. Why do not you come up with a counter list even of a fraction of the above mentioned data to prove your case?

If you think that Rebhip evasion techniques were able to stop AV industry, you can see the detection rate here:

http://www.virustotal.com/file-scan/report.html?id=f854a28eff3f85f96f8f1d7f281c3d072098534448000d49e289b73d5e650b17-1278356440

Anyways, I respect your freedom of speech right just like I do for “advanced_comentator” who is saying malware authors the brave guys and AV industry on a whole bad money suckers.

ok commented on 'The Dead Giveaways of VM-Aware Malware '

2011-01-28T05:38:07Z

Really? You just complained of fud based on a claim of no data, but provide no data to make your own. Flimflam.
Ever take a real look at what doesn't run on TE? Can't tell from this writeup if you did.

Mark D. Adams commented on 'The Dead Giveaways of VM-Aware Malware '

2011-01-28T05:09:41Z

Nice write-up. I guess I need to make my own proprietary VM. I don't have the time to disassemble that much anymore. It seems like the easiest way to defeat automated analysis though, is to simply wait for a specific user action to do something malicious.

advanced_comentator commented on 'The Dead Giveaways of VM-Aware Malware '

2011-01-28T05:01:33Z

>how the bad buys
>bad buys
Why AV companies always mixing truth? They are not "bad guys", they are good and brave guys. Trying to return their money from fat and dirty capitalists. Who are bad guys then? Answer is AV industry. They can't protect users from real attacks, such as stuxnet or conficker, just doing their PR and sucking money from innocent users.