[black_chance]

hello my friends :)
In the analysis of malware in virtual environments is one of the problems of the environment by malware is detected.
What approach for the virtual machine is not detected there by malware?
thank you for hellping my friends :D :D

[EP_X0FF]

hello my friends :)
In the analysis of malware in virtual environments is one of the problems of the environment by malware is detected.
What approach for the virtual machine is not detected there by malware?
thank you for hellping my friends :D :D

If you are analysing malware yourself, then you better know what they detect and how this can be solved. If not, change your bussiness model.

[black_chance]

I know it that they how to detect virtual machines for analysis But I want to know what ways have the ability to identify the machines..؟
I am an amateur analyst and new ways for me to have fun and experience. :)
Please understand me up to date ways to identify virtual machines by malware guidance :D :D

[EP_X0FF]

I know it that they how to detect virtual machines for analysis But I want to know what ways have the ability to identify the machines..؟
I am an amateur analyst and new ways for me to have fun and experience. :)
Please understand me up to date ways to identify virtual machines by malware guidance :D :D

Take malware and reverse. VM detect found? Develop countermeasures. You cant? Then this scope obviously not for you.

[one]

you just should analysis it,because there is many way that the malware can detect the vm envirment!

[Patrick]

I know it that they how to detect virtual machines for analysis But I want to know what ways have the ability to identify the machines..؟
I am an amateur analyst and new ways for me to have fun and experience. :)
Please understand me up to date ways to identify virtual machines by malware guidance :D :D

Unfortunately, we can't just 'teach you'. There's a reason we have journalists with zero kernel analysis or development skills making ill-informed articles because they are unaware and don't do their research, and on the other hand a reason we have detailed (and hopefully correct) whitepapers from vendors, or even threads here on kernelmode. If you take your time and do your research with a will to learn, you will learn. We can however point you in the right direction for you to start learning, and that's to read about anti-debugging & anti-vm.

A good place to start would probably be Joanna Rutkowska's Red Pill, I guess? http://repo.hackerzvoice.net/depot_ouah ... 0Pill.html

Look also for popular malware that makes use of anti-vm. For example, Andromeda - http://www.kernelmode.info/forum/viewto ... =andromeda

See also Phase, a relatively new copy/paste Poweliks fileless trojan - http://www.kernelmode.info/forum/viewto ... =16&t=3628

[Blaze]

I"d also like to add the following:

Pafish - tool that performs some anti(debugger/VM/sandbox) tricks
https://github.com/a0rtega/pafish
It's open source, so this should help you tremendously.


Bypassing Sandboxes for Fun
https://www.botconf.eu/bypassing-sandboxes-for-fun/
Some additional information.