In recent cases, some malware are checking the environment when being executed. These malware will not run in virtualization products, such as VirtualBox, VMware, KVM. Alberto Ortega wrote of an interesting way of hardening Cuckoo Sandbox against malware that can detect the presence of virtualizations.
As written in labs.alienvault.com, we will use Pafish (Paranoid Fish) to detect if our virtualization environment is able to evade those anti-debuggers/sandboxes/VMs. Pafish is a tool that can run an anti-debugger/VM/sandbox when executed. These technique are often used by malware to avoid analyses. You can download Pafish at https://github.com/a0rtega/pafish.git. For your VM, run the following command lines to install Pafish:
$ sudo mkdir pafish $ sudo git clone https://github.com/a0rtega/pafish.git pafish/
One of the core elements of Cuckoo Sandbox is CuckooMon, which provides Cuckoo Sandbox with the ability to intercept the execution flow of...
