Virtualization/Sandbox Evasion: System Checks

Astaroth can check for Windows product ID's used by sandboxes and usernames and disk serial numbers associated with analyst environments.^[4]

Attor can detect whether it is executed in some virtualized or emulated environment by searching for specific artifacts, such as communication with I/O ports and using VM-specific instructions.^[5]

BadPatch attempts to detect if it is being run in a Virtual Machine (VM) using a WMI query for disk drive name, BIOS, and motherboard information. ^[6]

BLUELIGHT can check to see if the infected machine has VM tools running.^[7]

CSPY Downloader can search loaded modules, PEB structure, file paths, Registry keys, and memory to determine if it is being debugged or running in a virtual environment.^[8]

Darkhotel malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names, if a filename ends with .Md5.exe, and if the program is executed from the root of the C:\ drive, as well as checks for sandbox-related libraries.^[9][10]

Denis ran multiple system checks, looking for processor and register characteristics, to evade emulation and analysis.^[11]

Dyre can detect sandbox analysis environments by inspecting the process list and Registry.^[12][13]

EvilBunny's dropper has checked the number of processes and the length and strings of its own file name to identify if the malware is in a sandbox environment.^[14]

Evilnum has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments. ^[15]

FinFisher obtains the hardware device list and checks if the MD5 of the vendor ID is equal to a predefined list in order to check for sandbox/virtualized environments.^[16]

Frankenstein has used WMI queries to check if various security applications were running, including VMWare and Virtualbox.^[17]

GoldMax will check if it is being run in a virtualized environment by comparing the collected MAC address to c8:27:cc:c2:37:5a.^[18][19]

Grandoreiro can detect VMWare via its I/O port and Virtual PC via the vpcext instruction.^[20]

GravityRAT uses WMI to check the BIOS and manufacturer information for strings like "VMWare", "Virtual", and "XEN" and another WMI request to get the current temperature of the hardware to determine if it's a virtual machine environment. ^[21]

GuLoader has the ability to perform anti-VM and anti-sandbox checks using string hashing, the API call EnumWindows, and checking for Qemu guest agent.^[22]

InvisiMole can check for artifacts of VirtualBox, Virtual PC and VMware environment, and terminate itself if they are detected.^[23]

Lucifer can check for specific usernames, computer names, device drivers, DLL's, and virtual devices associated with sandboxed environments and can enter an infinite loop and stop itself if any are detected.^[24]

MegaCortex has checked the number of CPUs in the system to avoid being run in a sandbox or emulator.^[25]

NativeZone has checked if Vmware or VirtualBox VM is running on a compromised host.^[26]

ObliqueRAT can halt execution if it identifies processes belonging to virtual machine software or analysis tools.^[27]

OilRig has used macros to verify if a mouse is connected to a compromised machine.^[28]

Okrum's loader can check the amount of physical memory and terminates itself if the host has less than 1.5 Gigabytes of physical memory in total.^[29]

OopsIE performs several anti-VM and sandbox checks on the victim's machine. One technique the group has used was to perform a WMI query SELECT * FROM MSAcpi_ThermalZoneTemperature to check the temperature to see if it’s running in a virtual environment.^[3]

OSX_OCEANLOTUS.D has variants that check a number of system parameters to see if it is being run on real hardware or in a virtual machine environment, such as sysctl hw.model.^[30][31]

P8RAT can check the compromised host for processes associated with VMware or VirtualBox environments.^[32]

PlugX checks if VMware tools is running in the background by searching for any process named "vmtoolsd". ^[33]

PoetRAT checked the size of the hard drive to determine if it was being run in a sandbox environment. In the event of sandbox detection, it would delete itself by overwriting the malware scripts with the contents of "License.txt" and exiting.^[34]

Pupy has a module that checks a number of indicators on the system to determine if its running on a virtual machine.^[35]

QakBot can check the compromised host for the presence of multiple executables associated with analysis tools and halt execution if any are found.^[36][37]

Remcos searches for Sandboxie and VMware on the system.^[38]

RogueRobin uses WMI to check BIOS version for VBOX, bochs, qemu, virtualbox, and vm to check for evidence that the script might be executing within an analysis environment. ^[39][40]

ROKRAT checks for sandboxing libraries.^[41][42]

Smoke Loader scans processes to perform anti-VM checks. ^[43]

SodaMaster can check for the presence of the Registry key HKEY_CLASSES_ROOT\Applications\VMwareHostOpen.exe before proceeding to its main functionality.^[32]

SUNBURST checked the domain name of the compromised host to verify it was running in a real environment.^[44]

SynAck checks its directory location in an attempt to avoid launching in a sandbox.^[45][46]

ThiefQuest uses a function named is_debugging to perform anti-debugging logic. The function invokes sysctl checking the returned value of P_TRACED. ThiefQuest also calls ptrace with the PTRACE_DENY_ATTACH flag to prevent debugging.

Trojan.Karagany can detect commonly used and generic virtualization platforms based primarily on drivers and file paths.^[47]

UBoatRAT checks for virtualization software such as VMWare, VirtualBox, or QEmu on the compromised machine.^[48]

WastedLocker checked if UCOMIEnumConnections and IActiveScriptParseProcedure32 Registry keys were detected as part of its anti-analysis technique.^[49]

yty has some basic anti-sandbox detection that tries to detect Virtual PC, Sandboxie, and VMware. ^[50]