Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Navigating the Vast Ocean of Sandbox Evasions

Summary: Unit 42's Palo Alto Networks malware team describes building its own custom hypervisor from scratch for dynamic analysis, because mainstream VM platforms like KVM, Xen and QEMU are well known to malware authors and every one of them has been targeted by sandbox evasions. The team catalogs evasion categories including API hook detection (with GuLoader unpatched ZwProtectVirtualMemory to restore original bytes), VM fingerprinting via the VMware backdoor interface and WMI queries, human-interaction checks such as GetLastUserInput and GetTickCount, and timing tricks like long sleeps, Windows timers and CPUID loops.

Bottom line: Malware that detects a sandbox simply does not behave maliciously, so a sample that looks clean in a mainstream VM may be hiding its payload entirely - and the team notes that nothing short of writing your own custom hypervisor would effectively address this class of evasions.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related