Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Evade Sandboxes With a Single Bit – the Trap Flag

Summary: Unit 42 documented that malware can detect whether it is running in a virtual machine or physical machine by setting the Trap Flag, the 8th bit in the Intel x86 EFLAGs register, and observing whether the resulting single-step exception lands on the expected instruction. The Lampion malware family, which targeted users in Portugal, used this check in x86 assembly with minimal Windows API calls and terminated its execution when it determined it was inside a VM.

What you should know: A sandbox built on a hypervisor that mishandles the Trap Flag will let Lampion-family samples see through the analysis environment and go quiet, so the sample you think you studied may never have shown its real behavior.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related