Malware developers are now checking if their malware is running in the Any.Run malware analysis service to prevent their malware from being easily analyzed by researchers.
Any.Run is a malware analysis sandbox service that lets researchers and users safely analyze malware without risk to their computers.
When an executable is submitted to Any.Run, the sandbox service will create a Windows virtual machine with an interactive remote desktop, and execute the submitted file within in it.
Researchers can utilize the interactive Windows desktop to see what behavior the malware is exhibiting, while Any.Run records its network activity, file activity, and registry changes.
Malware begins to detect if running in Any.Run
In a new password-stealing trojan spam campaign discovered by security researcher JAMESWT, malicious PowerShell scripts are downloading and installing malware onto a computer.
When the above script is executed, it will download two PowerShell scripts to the victim’s computer that contain obfuscated and embedded malware.
The above script will decode the embedded malware and execute it on the computer.
When the second script is run, it will attempt to launch what appears to be the Azorult password-stealing Trojan.
If it detects that the program is running on Any.Run, it will display the message ‘Any.run Deteceted!’ and exit. This will cause the malware to not be executed so that the sandbox cannot analyze it.
Using this method, threat actors make it more difficult for researchers to analyze their attacks using an automated system.
When executed on a normal virtual machine, or a live system, the password-stealing Trojan would be allowed to execute and steal saved login credentials in browsers, FTP programs, and other software.
While this will not prevent a researcher from analyzing a particular malware using other methods, it does cause them to have to put more effort into the analysis.
With online malware analysis sandbox platforms becoming more commonly used by security researchers, we can expect to see more malware continue to target them.
To read the original article: