0

Recently, I downloaded some malware samples for incident response practice. Then I installed them in a VirtualBox Windows 7 guest machine, but they are not working properly.

I disabled anti-virus and firewall but they are not showing their behavior. Remember I am not talking about the trojan's network traffic. What settings I have to enable in Windows 7 guest or VirtualBox to get my work done?

closed as too broad by Xander, techraf, Steffen Ullrich, schroeder Oct 9 '16 at 14:14

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Is the machine able to run 64 bit applications(only applies if malware is 64 bit). If not, what makes you think the malware doesn't have antivm features? – Stoud Oct 8 '16 at 18:23
  • 1
    Unfortunately, this question amounts to "my software isn't working, what do I do?" Unless we have a LOT more info, we can't possibly answer the question. What behaviour is expected? Is there a anti-VM feature in the malware? How do know the behaviour did not trigger? Do you know if the malware was triggered? Is the trojan compatible with your environment? – schroeder Oct 8 '16 at 20:33
1

If I understood it right, you're trying to deliberately infect your VM but the malwares you downloaded don't seem to work properly.

Assuming you don't try to launch 64-bit malware in a 32-bit VM, or malware created for another edition or version of Windows, the most probable cause for me is that your malwares try to detect if they are running in a VM or on a computer that's used for actual work, and disabling themselves to avoid detection (mostly to make it harder for antivirus firms to detect and study them).

As an example, some malwares in the wild have recently been found to count Word documents in the current user's folder ; they assume that if this number is close to zero the computer is likely to be only a test machine, and they stop there.

  • Actually i have tried till 20 of the malwares and i ensured that i am running some windows 7 portable malwares and they are 32-bit too. – ashok Oct 9 '16 at 3:55
  • You'll need to provide way more details if you want a helpful answer by someone that knows more about it than I do. – Elzo Oct 9 '16 at 7:43
0

Actually there are some different parameters that can change the way a software (In this case Malware) works on VM, comparing to a real machine.

First, you should be confident about (x86,x64) supporting, configuring VM network settings the way that malware be isolated from your Real machine network ,though concurrently malware can connect to Internet and CNC server, ...

Secondly, some malwares and even commercial products always check the running environment and if VM is detected they will change their behavior to avoid analysis. In reverse-engineering it's not so hard to find VM checks on assembly.

Final Note: I provide some information to solve your problem. but we can't give you any exact solution because we have no details about your problem.

Not the answer you're looking for? Browse other questions tagged or ask your own question.