Reverse Engineering Anti-VM Detections in Malware - Subscriber Request Part 2

[@taedopalleb1373]

Man, this is fascinating. I'm still getting my feet wet with malware analysis and this channel is a godsend for noobs like me. I'm curious, before these VM detection methods became well-known how does one find out about those VM only instructions?

[@OALABS]

Hey thanks glad to hear you are enjoying the vids! So most of these VM detections are actually the work of a lot of researchers. When hypervisors were first becoming popular there was a gold rush to try and find detections like these. Probably the most famous is the "Red Pill" research from Joanna Rutkowska (a super interesting read) web.archive.org/web/20070911024318/invisiblethings.org/papers/redpill.html but over the years there have been many discoveries like these. Once the work is published the detections are quickly adopted my malware authors for use in their code.

[@Dead4Light]

Thanks for Uploading! :)

[@mlonfx2410]

Amazing video ! Thank you very much !

[@jasonwick9449]

I run into this on occasion, but it's always so heavily obfuscated in the surrounding areas. It's often the case that I hook something like shutdown, but the code has intentionally mangled EBP so I can't just step back through the stack to find out where the vm-detection was found (and nor does EBP need to be valid, since the malware expects a shutdown to occur and doesn't expect a ret to ever take place). Combine that with dynamically resolved APIs that appear to be passed through rundll32 checks against the target process to have a third-party detect the hooks in the first-party and I feel like I can't reach the VM detection (or whatever other anti-anti debug method) from either direction -- neither forward (by following logical code execution) nor backward (by hooking the final payload and stepping back through ret's). I wish I understood more of your universal approach, at a high level. It's easy for you to say "Well, I know what I'm doing and what to expect, so this is what I do." I think what might be great is if you made a flow chart of your approach. What order do you do things, and what indicators make you set certain hooks? How would you handle something that's seriously packed, for example, through something like Themida? I know that Themida isn't a common use-case for packed malware, but I have seen it twice since 2016 and basically gave up before I even began. Understanding how you tackle some really tough malware and all the various approaches you took, what worked and what didn't, and how you deduced the correct path in a sea of incorrect paths.. that would be incredible. I hope you read this and consider it for a future video some day. Have fun at Defcon, Sergei! Maybe I'll see you there!

[@OALABS]

Hey Jason, you raise a really good point, and probably something that a lot of folks have thought at some point or another while trying to take what we talk about on this channel then apply it in the wild to new malware samples. So unfortunately the tl;dr is that there is no simple solution, and certainly no generic approach that will work for all packed samples. But, the good news is we can get pretty far with what we show on the channel. We tend to break this down into three categories when thinking about unpacking. Basic packers: So the majority of malware we see day-to-day can be unpacked in a few seconds using the simple breakpoint techniques we show in our tutorials. No need to hide the VM and no need to even hide the debugger. We have been working a comprehensive course that covers all these techniques in a set of progressive steps to make the learning easier but, if you just want the raw techniques we have covered most of them already in our videos. Basic packers with anti-analysis: When you run into one of these, the approach we show in this tutorial may work, and it's less expensive than other approaches. In our experience there will just be one or two anti-analysis check functions that can be skipped over and then you can proceed with the unpacking. However, as you have noted, this isn't always the case. If the binary contain heavy evasion (especially what you have described, opaque predicates, call stack manipulation, etc.) this approach can quickly fail. Unfortunately though, this is also the limit of what we are comfortable demonstrating on KZbin. Advanced packers, obfuscation, virtual machines: This is the category of "packers" that I think you are describing, especially if you are talking about Themida etc. So, if you have the misfortune to encounter something like this you are now talking about the 1% of malware. Rarely will a generic approach help you in these situations. Usually there is a specific tailored solutions for each packer, and these take a lot of time and resources to develop. We aren't comfortable sharing these specific techniques publicly for two reasons. First, they are unique to the packer and thus the packer developers could simply alter their code and void a lot of our work. Second, most of the seriously difficult packers are dual-use for both commercial software and malware. You need only look at the comments on our videos to see how many people want an easy solution to breaking these protections so they can pirate software. We don't want to be a part of that. However, the special project we are working on may be able to help a bit with this... In the mean time if you ever run into something like this we are always happy to take a look if you post the sample to VT and send us the hash. I know this is probably not the answer you were looking for, but I hope I have explained the reasoning behind it. All the best, Sergei

[@jasonwick9449]

​@@OALABS I appreciate the extremely thorough reply, Sergei! Would you ever consider putting out some ideas for how people (like yourself) have developed these custom solutions to unpacking the "very hard" packers? I'm not necessarily looking for something like "Well if your yara rules match abc, then go ahead and run this script from my github." I'm thinking more like "When I'm confronted with a VeryHardPacker as mentioned, I first hook APIs in a debugger, look for details, create a lot of individual x64dbg scripts to ultimately dump the core stuff to a file, and then blah blah." A super generic "high level approach" to how one builds a custom unpacker would be helpful. I just feel like that's where I will learn the most and improve the most in my reversing abilities. That said, I'm looking forward to the super secret project you've been working on!

[@OALABS]

For sure! This was sort of the idea behind developing our unpacking course ... providing a methodology for attacking some of the more difficult problems step-by-step. But as I noted in many cases this quickly turns into just full-on reverse engineering instead of a set of steps that you can follow. If you send us some samples (VT hashes only please) I can take a look and see if there is a good example to use to explain how I would approach this.

[@jasonwick9449]

@@OALABS Awesome. Thanks Sergei! I tend to run into something like this every 2-3 months, and I might have a leftover VM of Shame from a failed attempt that I can find an older one and grab a VT hash of. Appreciate the help!

[@typedeaf]

Thanks! FYI IDA is showing you the on-disk offset right next to the in-memory offset, at the bottom of your code window.

[@carlosribeiro1866]

Awsome channel ;)

[@TheBekabe]

Amazing. But I did not found where the scene that virus running?

[@OALABS]

Sorry I forgot to provide a link to the patched sample that will run in the sandbox you can download it from Malshare here (you will need to register for a free account): malshare.com/sample.php?action=detail&hash=9c8e3500e013982a4cbe2ba6fea801f4 We didn't show running the sample after it is patched but you can try it yourself or check out the Hybrid Analysis here: www.hybrid-analysis.com/sample/589da12984e7d4a85ed714e74ff7ff86c4f7083966fd105d44ab15202beb1454?environmentId=100

[@ahmedbellil5161]

very smart man

[@Luffy.9757]

that vm detection is in xenos 64

[@mallikarjunfp23]

Hi can you please analyse full malware from start to end its avctivity, it will help the tricks you follow,steps you take. hope to see soon. Thanks for your wonderful tutorial.

[@OALABS]

We are working on something like that... it takes time though : )

[@mallikarjunfp23]

OALabs we all are waiting for the same

[@XJacksonvilleX]

But what is an AntiVM?

[@robinhood3841]

Is a technique used by malware authors to hide their malware from being running under the virtualization machine