Anti-virtual machines and emulations

Abstract

Virtual Machines are important infrastructural tools for malware analysis. They provide safe yet accurate way of evaluating real life behavior and impact of any executable code, thus providing a better understanding of obfuscated or non conventional portions of code within a binary file. Many virtual machines, such as VMware, Qemu, VirtualBox and SandBoxes, are available and are widely adopted by malware researchers and analysts. Moreover, many antivirus scanners have their own implementation of emulators to achieve comparable results by running malicious code within a controlled environment in order to decrypt obfuscated code. Virus writers have always responded to these technologies. Most malware today uses anti-debug techniques to counter analysis and evade antivirus detection. Lately, malware like Zeus/SpyEye and associated families such as Smoaler, Dromedan, Kazy, Yakes, and other malware such as Spyrat or W32.Pilleuz, have deployed techniques to disrupt the use of virtual machines and emulators. These malware families are able to implement different variations of disruption techniques within single samples or within related groups of malware before propagation. This paper will present a study of these anti-emulation and anti-virtual machine techniques.