3 ms·
This has become really common. Most modern malware sandboxes attempt to greatly accelerate the system clock to account for this, in addition to trying to detect
by meowface 10y ago
This has become really common. Most modern malware sandboxes attempt to greatly accelerate the system clock to account for this, in addition to trying to detect and intercept long sleep (or equivalent) calls.
Like most long cat-and-mouse games, modern malware families all use a combination of many different tricks and anti-sandbox/analysis techniques. The sandboxes play whack-a-mole at the same rate as malware keeps adding more moles.
- Tinyyy 10y agoIf the malware attempts a CPU test that maxes out the host CPU, will it be obvious that the system clock is sped up?
- cnvogel 10y agoSo… only speedup the clock while the software under test is sleeping (waiting on a muted, timer,…) . Stealthy software shouldnt have excessive cpu consumption, otherwise people will investigate. It's obviously a cat & mouse game.
- Senji 10y agoI propose a scorched earth tactic. Refuse to run unsigned code.