Malware figures out it's running on VMs and refuses to execute Malware writers are looking for the absence of documents to figure out which PCs are potential victims and which are virtual machines being used by white hats. SentinelOne senior researcher Caleb Fenton found the novel technique while attempting to coax the malware into activating so it could be analysed. The worm he was …
Behind paranoid eyes.
Yes, the wondrous cat-and-mouse game! Remember when the malware would just look in the registry to figure out if it was running on a virtual machine? Now it's using limited heuristics. Anybody want to guess when malware will be coming in phases, a part A and B?
Most-Recently-Used, most likely...
There's a lot of MRU lists populated in your typical windows installation - recent word, excel, publisher documents. Recent jpegs opened, recent folders visited, network locations browsed, internet history etc. Lots of places that a "real" machine will populate with evidence of actual work.
"each app could itself become a vector, raising the chance the VM can jump the tracks and get pwned in a way the researcher doesn't detect..."
I'd still rather have that happen on a researcher's machine (where it bears a better-than-average chance of being detected) than on the average person's.
Posted anon for obv reasons...
We run our whole Windows\Citrix desktop environment in VMware.
Cerber (or Cerber2) got in somehow, executed on a Citrix desktop, checked the machine's PCI devices for known VMware devices, found them, terminated itself before doing anything more than changing the user's desktop to a standard 'All your base are belong to us' message asking for money and providing links.
Bullet dodged.
Or from it's point of view - gun, meet shoe.
Appsense Application Manager shall be deployed quick time to avoid this in future!
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
