5

We have several binaries of the ransomware Locky. We tried to run it in a virtual machine, which has several storages like Samba, etc. attached, in order to see how the files are going to be encrypted.

Basically it starts, spawns its process and then quits for no apparent reason. Nothing happens.

What could cause such a behaviour?

  • "Has anyone tried this" questions are probably off-topic for this site (see the Help section). That said, I think you are actually asking if anyone has any insight into what may be causing your problems and what you can do to fix it. If that's correct, you may want to edit your question so that it doesn't get closed. – Neil Smithline Mar 14 '16 at 22:05
  • 8
    There is a good chance it is designed to detect VMs and to stop running if it believes it is in one. That or there is a time delay. – d1str0 Mar 14 '16 at 22:08
  • 5
    VM detection is definitely a possibility. If the binaries are old, it may also be that the command-and-control servers the malware talks to have been taken down, so it can no longer download the keys it needs to encrypt the files. You can try running a wireshark capture while launching the malware to see if there are any failed connection attempts. – tlng05 Mar 14 '16 at 22:19
  • 2
    Ransomware also has a function that checks for certain pc-names, like test/sandbox/etc. If it detects these kind of names, the ransomware wont run. – mike-stokkel Mar 15 '16 at 8:26
5

Many instances of modern malware are VM-aware to make exactly such examinations more difficult. The malware will attempt to detect if it is running inside a VM as one of its first functions and then simply terminate if that is the case. This will be done prior to the remainder of the payload being decrypted in order to expose as little as possible to forensics examiners.

I don't know about Locky in particular, but it would not be surprising in the least if Locky's authors were using this very common tactic.

See here for a good overview of this phenomenon: https://blog.malwarebytes.org/intelligence/2014/02/a-look-at-malware-with-virtual-machine-detection/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.