Malware these days is actually quite complex.
It's doing a bunch of checks.
It's doing a bunch of things to make sure it doesn't wanna get caught.
That kind of thing, right?
Yes, a lot of malware today has anti‑analysis checks,
so it's going to be looking for the tools that you're running.
It has anti‑VM checks to make sure that it's not running in a virtual machine.
We're seeing less and less of that,
especially in newer malware just because virtual machines are just so
prevalent in an enterprise. I can't think of any major organization
that doesn't have virtualization in there.
And so the malware authors have kind of realized,
Well,
maybe I don't necessarily want to not run on a system that's
virtualized because that could be a system within an
organization that I do want to compromise.
So instead they're looking at, Is this computer running a debugger? Is
it trying to debug me? Is it running any of the common analysis tools
like process monitor or process explorer?
Some of those tools we'll talk about later on. And there are
ways that you can get around these checks. Some of them are a
bit more complicated than others.
But we'll talk about ways that we can either modify our virtual
machine to get around the anti‑VM checks if they exist,
and then ways that we can kind of modify our tools themselves to
kind of get around some of these simple checks.
You're never going to be able to get around everything.
There's always going to be something that catches you.
And so you always have the option to fall back to using an
actual piece of hardware with the OS installed on it without
any virtualization if you need to.
But at least we'll talk about the ways that you can protect yourself and
make some changes to kind of hide from these checks, and so you can try to
bypass them without having to go that route.