Once loose in the digital jungle, malware does everything possible to infect as many computers as it can, but this traditional behavior can backfire if there is a researcher waiting on the other side. Many developers have modified their bugs to avoid installing on virtual machines, which is achieved by detecting certain processes associated with resources like VirtualBox and VMWare. AntiFooling is a tool whose objective is to simulate those processes on a normal computer, and thus trick malware.
How Malware Tries to Evade Detection
Malware developers want their creations to reach every corner, and of course, not be caught in the process. Once a security expert or researcher obtains a copy, they can likely shape some tool or mechanism that blocks its operation. Another important aspect is studying the behavior of malware inside a virtual machine, but there are already many variants capable of recognizing whether they are inside an isolated environment. VMWare and VirtualBox add a series of processes to their guest systems that ensure proper operation of elements like audio, video, and input devices. Malware only needs to detect the presence of those processes to avoid unwanted exposure. But what if we use that against it...?
AntiFooling: A Clever Deception
That's when AntiFooling appears, a tool created by user Scorpio from the Indetectables.net forum. In short, AntiFooling tricks malware by installing on a conventional computer those processes we see inside a virtual machine. With this technique, malware cannot differentiate a real computer from a virtual one, and to protect its integrity it avoids infecting it. AntiFooling offers two routes: Simulate a VirtualBox environment or a VMWare one. In theory, the two should be equally effective, since it makes no sense to block a virtual machine and ignore the other, although it is possible to activate both at the same time. AntiFooling does not require a formal installation, and to schedule its startup with the operating system, we only need to check a box.
Technical Details and Download
Personally, I don't think there will be distribution problems for AntiFooling, because the processes in question were not extracted from their original programs, but rather are something like “placeholders”, with a size of 808 kilobytes in all cases (312 KB in the x32 edition). AntiFooling is an interesting form of protection; however, the ideal is that malware never reaches our computers in the first place...
(Editor's note: Access to the download requires an account on Indetectables, but the link goes directly to a copy hosted on Sendspace.)
