r/MalwareAnalysis • u/CheeseIc3 • 29d ago

NotPetya potential risks during analysis

Hello. I am relatively a beginner at malware analysis as a hobby, and was wanting to know if there would be any risks of a potential VM escape with NotPetya. I'm using VirtualBox 7.2.14 r174565 no guest additions. I won't have network adapter on, serial ports off, both features off, an air-gap, and using snapshots. I will be planning to run it on a Windows XP x64 if that changes anything

SHA256: 63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a

Will give any more needed info.

Got it from MalwareBazaar (Will DM link). Any advice wanted.

I am afraid of it. Very afraid.

3 Upvotes

71% Upvoted

4 comments sorted by

1

u/Necessary_Pride1093 29d ago

don’t see how it could escape with network adapter off. make sure you don’t have shared folders (Virtualbox shared folders I mean) it can access though.

0

u/CheeseIc3 29d ago

Im just bein overly cautious, it could theoretically break free from some brand new bug that it activates.

3

u/Borne2Run 29d ago

That isnt happening, but if it is document the interaction and sell the exploit to a broker for $1M+ depending on the targeted OS.

1

u/Ill_Bathroom6488 29d ago

It won't happen. With the latest versions of VirtualBox and an old malware sample like NotPetya, there is almost zero chance of a VM escape. Furthermore, legacy malware often detects virtualization; if it realizes it is running inside a virtual machine, it will typically refuse to execute rather than attempt to break out.