There is a malware family out there that managed to outwit a couple of security researchers. Multiple layers of VM/debugger detection layers were present in a m

There is a malware family out there that managed to outwit a couple of security researchers. Multiple layers of VM/debugger detection layers were present in a malware sample. If a debugger or VM was detected it would drop a generic adware sample to disguise the true intent. Additionally, telemetry designed to look adwareish would sent to the CnC servers, blacklisting your IP so that you'd only ever receive the adware from that point on even if you managed to bypass the additional layers of protection that were previously missed. https://foxitsecurity.files.wordpress.com/2015/12/foxit-whitepaper_ponmocup_1_1.pdf https://foxitsecurity.files.wordpress.com/2015/12/foxit-whit...