Malware authors know that if their malware sample is running on a virtual machine, then it's probably being analyzed by a reverse engineer or it's probably running under the analysis of an automated tool such as a sandbox. There are multiple ways in which malware authors can detect virtual machines and sandboxes. Let's go over some of them now.
Detecting sandboxes and virtual machines
Different output between virtual machines and real machines
Nothing is perfect. Therefore, malware authors use the mistakes of the virtual machines' implementations in some of the assembly instructions. Examples of these are as follows:
- CPUID hypervisor bit: The CPUID instruction returns information about the CPU and provides a leaf...
