Automated Malware Analysis: Summary of recent Anti-Sandbox Tricks
Regardless of the technology being used maintaining an efficient sandbox requires to continuously monitor new malware samples in order to effectively cope with new evasion techniques. Today we want to share some of the techniques that we have spotted during the last couple of months. We mentioned some of these already briefly on our Twitter feed.
News from the Lab Archive : January 2004 to September 2015
Malware authors certainly do not take a breather when it comes to inventing new tricks for detecting sandbox, a very useful system to automatically analyze millions of samples nowadays. Recently, Seculert unveiled an unprecedented sandbox detection method that was employed by the Dyre/Dyreza malware. We have seen similar anti-sandbox tricks used by the notorious Tinba banking trojan and would like
Anti-forensics – live examples - Hexacorn | Blog
Amongst many various techniques that are used by malware to prevent its detection and analysis (e.g. rootkits, disabling OS tools, anti-debug, anti-disasm, anti-dumping, anti-VM, anti-sandbox, etc.), there are a few that are not so common, yet still “make it ” to some malicious releases. These techniques do not prevent malware analysis itself, but aim at making it difficult for forensic guys to an
News from the Lab Archive : January 2004 to September 2015
One of our analysts has discovered something interesting while debugging the latest version of Flashback, a Mac trojan that attempts to trick people into believing it's an Adobe Flash Player update. While comparing the differences between Flashback.A and Flashback.B, he saw this routine: Flashback.B performs a "vmcheck". If virtualization is detected, the trojan aborts itself. Apple started allowi
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
処理を実行中です
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Win32/Duqu: It’s A Date | ESET ThreatBlog
Anti-VM check through IOCTL_STORAGE_QUERY_PROPERTY | Norman Blogs
マカフィー株式会社 | McAfee Blog - 偽セキュリティソフト、再び拡大の恐れ
[PDF]Towards an Understanding of Anti-virtualization and Anti-debugging Behavior in Modern Malware
