5

We have several binaries of the ransomware Locky. We tried to run it in a virtual machine, which has several storages like Samba, etc. attached, in order to see how the files are going to be encrypted.

Basically it starts, spawns its process and then quits for no apparent reason. Nothing happens.

What could cause such a behaviour?

Improve this question
4
  • "Has anyone tried this" questions are probably off-topic for this site (see the Help section). That said, I think you are actually asking if anyone has any insight into what may be causing your problems and what you can do to fix it. If that's correct, you may want to edit your question so that it doesn't get closed.
    – Neil Smithline
    Commented Mar 14, 2016 at 22:05
  • 8
    There is a good chance it is designed to detect VMs and to stop running if it believes it is in one. That or there is a time delay.
    – d1str0
    Commented Mar 14, 2016 at 22:08
  • 5
    VM detection is definitely a possibility. If the binaries are old, it may also be that the command-and-control servers the malware talks to have been taken down, so it can no longer download the keys it needs to encrypt the files. You can try running a wireshark capture while launching the malware to see if there are any failed connection attempts.
    – tlng05
    Commented Mar 14, 2016 at 22:19
  • 2
    Ransomware also has a function that checks for certain pc-names, like test/sandbox/etc. If it detects these kind of names, the ransomware wont run.
    – mike-stokkel
    Commented Mar 15, 2016 at 8:26

1 Answer 1

Reset to default
5

Many instances of modern malware are VM-aware to make exactly such examinations more difficult. The malware will attempt to detect if it is running inside a VM as one of its first functions and then simply terminate if that is the case. This will be done prior to the remainder of the payload being decrypted in order to expose as little as possible to forensics examiners.

I don't know about Locky in particular, but it would not be surprising in the least if Locky's authors were using this very common tactic.

See here for a good overview of this phenomenon: https://blog.malwarebytes.org/intelligence/2014/02/a-look-at-malware-with-virtual-machine-detection/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .