Stealth Virtualization: A Tool for Hiding VM Traces in VirtualBox

When a Virtual Environment Gives Itself Away

Ever encountered a suspicious file that behaves differently in a virtual machine than on real hardware? Many modern malware strains can detect VMs and alter their behavior to complicate analysis. This is exactly the problem that Mikael's (nsmfoo) anti-detection script solves.

What is antivmdetection?

This is a Python script that generates:

• A template for VirtualBox configuration (runs on the host)
• A PowerShell script for fine-tuning a Windows guest OS
• A DSDT dump (ACPI tables)

The main advantage is the approach without modifying the VirtualBox kernel. All changes are made through standard APIs and settings.

Who is this for?

• Malware analysts
• Security researchers
• Antivirus solution developers
• Cybersecurity enthusiasts

How It Works: 5 Key Features

1. Hardware Feature Masking

   • CPU and BIOS ID spoofing
   • Generation of realistic firmware release dates
   • Disk controller configuration (IDE/SATA)

2. System Parameter Randomization

   • Computer and username
   • Disk VolumeIDs
   • Clipboard
   • Desktop background images

3. Creating a Believable Environment

   • Generation of "junk" documents
   • File association configuration
   • User activity simulation

4. Windows Registry Manipulation

   • ProductId and DigitalProductId spoofing
   • License key trace cleanup
   • Internet Explorer parameter configuration

5. Flexible Configuration

   • Windows 7 and 10 support
   • Ability to specify custom name lists for randomization
   • Separation of settings into those requiring and not requiring a reboot

Technical Implementation Details

The script uses:

• Python 3 for template generation
• ACPI tools for working with DSDT tables
• System utilities (dmidecode, smartmontools)
• Windows PowerShell for fine-tuning the guest OS

Architecturally, the solution is divided into two parts:

1. Template generator (host)
2. Fine-tuning script (guest)

Practical Applications

Scenario 1: Malware Analysis

When you need to study the behavior of malware that checks for virtualization indicators.

Scenario 2: Testing Protective Mechanisms

Checking how well your product detects VMs in pentest scenarios.

Scenario 3: Creating Training Environments

Preparing realistic virtual machines for information security courses.

Configuration Example

# На хосте
sudo apt install python3-pip libcdio-utils acpica-tools mesa-utils smartmontools
sudo pip3 install -r requirements.txt
wget https://download.sysinternals.com/files/VolumeId.zip
wget https://www.nirsoft.net/utils/devmanview-x64.zip
sudo python3 antivmdetect.py
/bin/bash generated_script.sh my-vm-name

# В гостевой ОС
# После первого запуска PowerShell-скрипта требуется перезагрузка

Limitations

• Works only with VirtualBox
• Requires manual intervention for some settings
• No support for recent Windows 11 versions

Conclusion: Is It Worth Trying?

The antivmdetection project is an excellent solution for:

• Researchers who need an "invisible" VM
• Security professionals
• Anyone working with suspicious executables

Although the project hasn't been updated since 2022, its core functionality remains relevant. For simple scenarios, the script works out of the box, and its modular structure makes it easy to adapt to your needs.

I recommend trying it if you need to:

• Check malware behavior in a "realistic" environment
• Test your VM detection systems
• Create a training lab for malware analysis courses

The project is available under the MIT license — you can freely use and modify it for your tasks.