4 ms·
They're more analysis defeaters than killswitches. Some testbeds will respond to all dns lookups as valid. If this is the case the binary assumes its in a testb
by Thrillington 9y ago
They're more analysis defeaters than killswitches. Some testbeds will respond to all dns lookups as valid. If this is the case the binary assumes its in a testbed and exits to avoid analysis.
- ckaygusu 9y agoI understand that it serves to defeat analysis, but... it sounds like it could be trivially circumvented. Why bother in the first place?
- fian 9y agoWhich makes me think there might be utility in always running Windows (or other OSes) in a VM. If the malware assumes VMs are bad and self exit in response, then it should be safer to run everthing in a VM. A side benefit would be you can perform snapshot backups and easily migrate your main environment to new hardware.
- kchr 9y agoYou might wanna take a look at Qubes OS, which tries to provide such workflow in a nicely packaged distribution: https://www.qubes-os.org/ https://www.qubes-os.org/