Hackers use single bit change in Intel CPU register to evade detection

Security researchers have discovered a specific single bit (Trap Flag) in the Intel CPU register that malware can abuse to evade sandbox detection.

According to researchers at Palo Alto Networks’ Unit 42 threat research group, malware can detect whether it is executing in a physical or virtual machine (VM) by monitoring the response of the CPU after setting this single bit.

Malware usually avoids detection by checking if it is being run in a virtualized “sandbox” environment set up to safely analyze potential malware. When the malware finds out it is executing in a virtual machine, it will terminate its execution or provide fake outputs to hide its real intentions. In this instance, to detect VM use in a sandbox, malware could check the CPU’s behavior after enabling the trap flag. This is the eighth single bit in the EFLAGs register of the Intel x86 CPU architecture.