Войти в систему
Войти с помощью соц. сетей:
Malware authors sometimes use anti-virtual machine (anti-VM) techniques to thwart attempts at analysis. With these techniques, the malware attempts to detect whether it is being run inside a virtual machine. If a virtual machine is detected, it can act differently or simply not run. This can, of course, cause problems for the analyst.
Anti-VM techniques are most commonly found in malware that is widely deployed, such as bots, scareware, and spyware (mostly because honeypots often use virtual machines and because this malware typically targets the average user’s machine, which is unlikely to be running a virtual machine).
The popularity of anti-VM malware has been going down recently, and this can be attributed to the great increase in the usage of virtualization. Traditionally, malware authors have used anti-VM techniques because they thought only analysts would be running the malware in a virtual machine. However, today both administrators and users use virtual machines in order to make it easy to rebuild a machine (rebuilding had been a tedious process, but virtual machines save time by allowing you to go back to a snapshot). Malware authors are starting to realize that just because a machine is a virtual machine does not necessarily mean that it isn’t a valuable victim. As virtualization continues to grow, anti-VM techniques will probably become even less common.
Because anti-VM techniques typically target VMware, in this chapter, we’ll focus on anti-VMware techniques. We’ll examine the most common techniques and how to defeat them by tweaking a couple of settings, removing software, or patching an executable.
Войти с помощью соц. сетей: