The infamous TrickBot trojan now checks the resolution on a machine's screen to detect if it is a virtual machine.
Malware typically uses anti-VM techniques to detect if it is running in a virtual machine, since in that case, it is likely to be analyzed by a researcher or an automated sandbox.
These anti-VM techniques include searching for specific processes, Windows , or machine names, and even checking network card MAC addresses or CPU.
TrickBot checks screen resolution
As MalwareLab researcher Maciej Kotowicz a new strain of the TrickBot Trojan now checks the screen resolution of an infected computerto determine if it is a virtual machine.
Initially, TrickBot was a simple Trojan, which evolved over time and now performs a number of other malicious activities.
Such activities include stealing stored credentials in browsers, stealing Active Directory service databases, stealing cookies and OpenSSH keys, stealing RDP, VNC, and PuTTY credentials, and more.
As Kotowicz stated in a tweet, the new TrickBot strain checks whether the computer's screen resolution is 800×600 or 1024×768 and if it is, it terminates.
TrickBot checks for these specific analyses, due to the way researchers typically configure malware analysis virtual machines.
When configuring a virtual machine, most researchers will not install the VM guest software, which allows for better screen resolutions, better mouse control, improved networking, and other features.
The software is not installed as malware typically controls files, registry keys, and processes used by the virtual machine's guest software.
Without guest software, however, a virtual machine typically does not allow resolutions higher than 800×600 and 1024×768, compared to standard screen resolutions which are much higher.
So the creators of TrickBot check the screen resolution to discover if it is a virtual machine and terminate the process.
