A new sample of TrickBot has been discovered which checks the screen resolution of victim’s machines in order to see if the malware is running inside a virtual machine.
In order to protect themselves and their systems when analyzing malware, security researchers often do so in a virtual machine. As a result of this, malware often employs anti-VM techniques to detect whether or not it is running in a virtual machine.
The anti-VM techniques used by malware include looking for particular processes, windows services, machine names and checking network card MAC addresses or CPU features.
If malware detects that it is indeed running in a virtual machine, it will stop its operations to avoid giving researchers further clues into how it works and who deployed it in the first place.
Screen resolution
Maciej Kotowicz from the cybersecurity firm MalwareLab found a new sample of the TrickBot Trojan that checks an infected computer’s screen resolution to determine if it’s a virtual machine.
TrickBot originally started out as a banking trojan but the malware has evolved to perform other malicious behavior including spreading laterally through a network, stealing saved credentials in browsers, stealing cookies and more.
Kotowicz first made his discovery public in a Tweet in which he revealed that a new sample of TrickBot is checking infected machines to see if they have a resolution of 800×600 or 1024×768. If either of these resolutions is found, TrickBot will stop running.
The reason the malware is checking for these two resolutions in particular is due to how researchers configure the virtual machines they use to analyze malware. When setting up a virtual machine, most researchers will not install the VM guest software that would allow them to use higher resolutions. Without this software installed, a virtual machine will usually not allow any resolutions other than 800×600 and 1024×768.
While unfortunate for researchers studying malware, this new anti-VM check is actually quite clever and hopefully other malware developers don’t follow suit and add this feature to their malicious software.
Source: techradar.com
