In previous posts, I described PuppetMaster, a way to dynamically detect and control CPU-based VMM detection methods in malware samples. We ran it on 2 sets of malware samples, and here are the results.

1. 60k samples from a Nepenthes honeypot

• 62498 samples on the honeypot
• 59554 of them being executable files
• 48404 were analysed “correctly”
• 13409 samples were terminated due to a 2 minutes timeout

The number of samples trying to detect virtualization is surprisingly low:

• 71 (0.15%) binaries used at least one anti-virtualization technique
• 65 (0.13%) binaries used the SIDT anti-virtualization technique
• 0 (0.00%) binaries used the STR anti-virtualization technique
• 0 (0.00%) binaries used the SLDT anti-virtualization technique
• 0 (0.00%) binaries used the SGDT anti-virtualization technique
• 14 (0.03%) binaries used the VMware channel anti-virtualization technique

2. 25k samples from uh… somewhere

These samples were shared by Paul Royal, so thanks Paul :)

• 25118 samples
• 23104 of them being executable files
• 18670 were analysed “correctly”
• 8298 samples were terminated due to a 2 minutes timeout

Again, the number of samples trying to detect virtualization is very low:

• 117 (0.63%) binaries used at least one anti-virtualization technique
• 56 (0.30%) binaries used the SIDT anti-virtualization technique
• 0 (0.00%) binaries used the STR anti-virtualization technique
• 2 (0.01%) binaries used the SLDT anti-virtualization technique
• 6 (0.03%) binaries used the SGDT anti-virtualization technique
• 58 (0.31%) binaries used the VMware channel anti-virtualization technique

Conclusion

There are a few potential reasons why the numbers are so low:

1. the samples used other techniques that we do not support (such as detecting the VMware tools, or hardware version)
2. or the samples we got are really not representative of malware samples in the wild. Indeed, our 60k samples contain mostly Allaple samples.
3. or anti-virtualization techniques are not that common in actual malware samples…

It would be interesting to run the test on better malware repositories, unfortunately this is not something obvious to get our hands on. So if you have a big malware repo ready to be dissected, and you would like to share them with an academic lab for free, I’d be glad to hear from you: reynaudd at loria dot fr.