Hacker News new | ask | show | jobs
by ttul 357 days ago
If you make your machine look like a malware execution sandbox, a lot of malware will terminate to avoid being analyzed. This is just part of the cat and mouse game.
7 comments

Yea sophisticated malware checks how many CPU cores PC has, how much hard drive space, some even check hardware temperature or if any debuggers are present. Windows malware got pretty sophisticated in the last 30 years.
any good read on how good they are nowadays ? (my background is cracking games 35 years ago :-))
I'm not a reverse engineer or a white hacker but I like reading about it. Most of the malware is made for Windows OS because of the Windows' enormous market share.

Majority of information about Windows malware I get from big computer security companies' research blogs like:

https://www.trendmicro.com/en_us/research.html

https://www.proofpoint.com/us/blog

https://research.checkpoint.com/

https://blog.talosintelligence.com/

https://www.welivesecurity.com/en/

Microsoft also got good security research blog: https://www.microsoft.com/en-us/security/blog/

Majority of the research combes down to researching malware's capabilities regarding malware persistence, anti-VM techniques and anti-debugging techniques.

Here is for example good compilation of malware's anti-debugging and anti-VM techniques:

https://anti-debug.checkpoint.com/

https://github.com/CheckPointSW/Evasions

Malware targeting Macs is booming, and, IMO, the most interesting malware targets iOS.

https://taomm.org/

https://citizenlab.ca/

https://objective-see.org/blog.html

Most windows servers are virtualised these days so I'm not sure this would work anymore. It might look at other indicators though
There's other tells, like this other top HN post right now tries to work around: https://wbenny.github.io/2025/06/29/i-made-my-vm-think-it-ha...
Put VirtualBox strings in your firmware :)
Yes, and don't forget to install the VirtualBox guest extensions in your host machine to make it looks even more like a VM!
Is there any downside to unironically doing this? Seems like it'd actually work.
Expect Oracles lawyers to send you a bill.
There is an oracle license attached to it
IIRC the extensions pack has a (very limited) free license for personal and educational use, although I'm not sure if the 'pretending to be a sandbox' usecase would be covered.
It’s not much harder to just harden your system to not be vulnerable in the first place, and that protects your from a lot more.
> It’s not much harder to just harden your system

'just' harden the system is not easy.

But installing something like a vmware guest driver is easy, as even a non-technical user can do it following some basic instructions.

Defense in depth
Agreed - like using a non admin account.
How does that protect against ransomware?
Please tell me what tools you use to receive future zero-day vulnerability patches.
To be fair the vast, vast majority of exploitation that we see (especially in the news) comes from sub-par security setups and poor training/architecture. That’s no even going into security monitoring which most companies don’t or barely have.

Zero days account for very small amount of exploitation in comparison and by definition are unpatched so I think the commenter was right to point out the basics.

Qubes OS should protect you even from unknown vulnerabilities as long as you use its compartmentalization approach. Works for me (or so I hope).
Wikipedia's page on "just intonation" is, oddly, about music.
OK. You've lost me.
And it is so too that “just deserts” are rarely desserts at all.
Anticheat might throw a fit
Don't play games on your production hardware. Easy fix.
Or don't play games that behave indistinguishably from ransomware.
Time to install Ghidra on every station
It was mentioned in the other front page article, I guess this is where we got this submission from: https://news.ycombinator.com/item?id=44413185
> If you make your machine look like a malware execution sandbox, a lot of malware will terminate to avoid being analyzed. This is just part of the cat and mouse game.

What? This is an entirely separate concern. If you have a Russian input method installed, malware will terminate to avoid legal repercussions.

They seem to be offering this as another means of getting the malware not to run. I don't read it strictly as an explanation of the Russian keyboard thing.
Any tutorials on how to do that?