Malware adds Any.Run sandbox detection to evade analysis

Malware developers are now checking if their malware is running in the Any.Run malware analysis service to prevent their malware from being easily analyzed by researchers.

Any.Run is a malware analysis sandbox service that lets researchers and users safely analyze malware without risk to their computers.

When an executable is submitted to Any.Run, the sandbox service will create a Windows virtual machine with an interactive remote desktop, and execute the submitted file within in it.

Researchers can utilize the interactive Windows desktop to see what behavior the malware is exhibiting, while Any.Run records its network activity, file activity, and registry changes.

Malware begins to detect if running in Any.Run

In a new password-stealing trojan spam campaign discovered by security researcher JAMESWT, malicious PowerShell scripts are downloading and installing malware onto a computer.

Malicious PowerShell script

When the above script is executed, it will download two PowerShell scripts to the victim’s computer that contain obfuscated and embedded malware.

The above script will decode the embedded malware and execute it on the computer.

When the second script is run, it will attempt to launch what appears to be the Azorult password-stealing Trojan.

If it detects that the program is running on Any.Run, it will display the message ‘ Deteceted!’ and exit. This will cause the malware to not be executed so that the sandbox cannot analyze it. Detected! Detected!

Using this method, threat actors make it more difficult for researchers to analyze their attacks using an automated system.

When executed on a normal virtual machine, or a live system, the password-stealing Trojan would be allowed to execute and steal saved login credentials in browsers, FTP programs, and other software.

While this will not prevent a researcher from analyzing a particular malware using other methods, it does cause them to have to put more effort into the analysis.

With online malware analysis sandbox platforms becoming more commonly used by security researchers, we can expect to see more malware continue to target them.


Next Post

The biggest flipping challenge in quantum computing | Science

Mon Jul 13 , 2020
ANDY GILMORE By Adrian ChoJul. 9, 2020 , 2:00 PM In October 2019, researchers at Google announced to great fanfare that their embryonic quantum computer had solved a problem that would overwhelm the best supercomputers. Some said the milestone, known as quantum supremacy, marked the dawn of the age of […]