Lately I've read a blog post for an advanced malware, that has a dropper that ensures that the victim machine is not used for malware analysis and if that's the case terminates.
So I'm thinking that it checks for installation of some software but I'm no expert, what it might be checking?
And how can I create a similar environment for purposes of security? Don't ask why I need it but I need it badly.
Different malware will do it differently.
A common technique is to check if the victim machine is a Virtual Machine or not. This can be achieved through tricks like redpill, or simpler quirks of virtualization like the presence of certain virtual network adapters. Obviously, this is not a great technique for malware aimed at servers/cloud, since it is not uncommon for such systems to be virtualized.
Another easy to implement technique is to check if the machine is realistic or not. This can include a wide range of checks like checking if the computer has a realistic number and variety of user documents and files on it. If there are no or very few files in the documents, downloads and desktop folders, the malware may decide that this is a suspicious machine and abort. Malware can be creative and check for things like when the OS was installed, if the user's browsing history is realistic or any other metric for determining whether or not the system looks like it is used by a real human being regularly or not.
More sophisticated malware will check for the presence of malware detection and analysis tools on the system. This would include decompilers/disassemblers (like IDAPro, objdump, ghidra etc), debuggers (like gdb, WinDbg), network-sniffing tools (like wireshark, tcpdump) and memory analysis/forensics tools (like Volatility). Malware can often also check to see if a debugger has been attached to it or not, or if any other process is inspecting its memory which would indicate that it is being analyzed.
Ultimately, none of these techniques are foolproof, and experienced malware analysts regularly work around them.
So how do you make your system look like an analysts?
The easy part is running it in a VM, and installing as many malware-analysis tools as possible. However, making your filesystem appear as if it is a fresh system or not regularly used does not seem too practical to me. And running everything in a debugger definitely won't be easy either. Keep in mind that even if you manage to do so, this will not be a panacea against all malware. In particular, malware aimed at low-hanging fruit and scriptkiddie malware often won't bother with these sort of checks.
