System, method, and computer program product for simulating at least one of a virtual environment and a debugging environment to prevent unwanted code from executing
View Patent ↗A system, method, and computer program product are provided for simulating at least one of a virtual environment and a debugging environment to prevent unwanted code from executing. In use, at least one of a virtual environment and a debugging environment is simulated. Additionally, unwanted code is prevented from executing as a result of the simulation.
1. A non-transitory computer readable medium comprising computer executable instructions stored thereon to cause a processor to:
identify a request to execute an executable file on a computer system, the executable file containing unwanted code that is created to be disabled from executing in at least one of a virtual environment and a debugging environment; and
simulate at least one of the virtual environment and the debugging environment based on the identification, wherein the unwanted code determines not to execute as a result of the simulation,
wherein the simulation comprises one or more innocuous actions to make the computer system appear to the unwanted code to be executing at least one of the virtual environment and the debugging environment when there is no virtual environment or debugging environment active.
2. The non-transitory computer readable medium of claim 1 , wherein the executable instructions to cause the processor to simulate at least one of the virtual environment and the debugging environment comprise instructions to cause the processor to simulate the virtual environment.
3. The non-transitory computer readable medium of claim 1 , wherein the executable instructions to cause the processor to simulate at least one of the virtual environment and the debugging environment comprise instructions to cause the processor to simulate the debugging environment.
4. The non-transitory computer readable medium of claim 1 , wherein the executable instructions to cause the processor to simulate at least one of the virtual environment and the debugging environment comprise instructions to cause the processor to simulate at least one of a file and a folder with a predetermined identifier.
5. The non-transitory computer readable medium of claim 1 , wherein the executable instructions to cause the processor to simulate at least one of the virtual environment and the debugging environment comprise instructions to cause the processor to simulate hardware with a predetermined identifier.
6. The non-transitory computer readable medium of claim 1 , wherein the executable instructions to cause the processor to simulate at least one of the virtual environment and the debugging environment comprise instructions to cause the processor to maintain a predetermined port open.
7. The non-transitory computer readable medium of claim 1 , wherein the executable instructions to cause the processor to simulate at least one of the virtual environment and the debugging environment comprise instructions to cause the processor to simulate an execution of a predetermined process.
8. The non-transitory computer readable medium of claim 1 , wherein the executable instructions to cause the processor to simulate at least one of the virtual environment and the debugging environment comprise instructions to cause the processor to simulate a predetermined central processing unit command.
9. The non-transitory computer readable medium of claim 1 , further comprising executable instructions to cause the processor to determine whether the executable file is protected.
10. The non-transitory computer readable medium of claim 9 , wherein the executable instructions to cause the processor to simulate at least one of the virtual environment and the debugging environment are conditionally disabled based on the determination.
11. The non-transitory computer readable medium of claim 1 , further comprising executable instructions to cause the processor to determine whether the executable file is packed.
12. The non-transitory computer readable medium of claim 11 , wherein the executable instructions to cause the processor to simulate at least one of the virtual environment and the debugging environment are conditionally disabled based on the determination.
13. The non-transitory computer readable medium of claim 1 , further comprising executable instructions to cause the processor to determine whether the executable file is legitimate.
14. The non-transitory computer readable medium of claim 13 , wherein the executable instructions to cause the processor to determine whether the executable file is legitimate comprise instructions to cause the processor to compare an identifier of the executable file against one or more file identifiers listed in a whitelist.
15. The non-transitory computer readable medium of claim 13 , wherein the executable instructions to cause the processor to simulate at least one of the virtual environment and the debugging environment are conditionally disabled based on the determination.
16. A method, comprising:
identifying a request to execute an executable file on a computer system, the executable file containing unwanted code that is created to be disabled from executing in at least one of a virtual environment and a debugging environment; and
simulating at least one of the virtual environment and the debugging environment based on the identification, wherein the unwanted code determines not to execute as a result of the simulation,
wherein, the simulation comprises one or more innocuous actions to make the computer system appear to the unwanted code to be executing at least one of the virtual environment and the debugging environment when there is no virtual environment or debugging environment active.
17. A system, comprising:
a memory; and
a processor operatively coupled to the memory, the processor adapted to execute program code stored in the memory to:
identify a request to execute an executable file on a computer system, the executable file containing unwanted code that is created to be disabled from executing in at least one of a virtual environment and a debugging environment, and
simulate at least one of the virtual environment and the debugging environment based on the identification, wherein the unwanted code determines not to execute as a result of the simulation,
wherein, the simulation comprises one or more innocuous actions to make the computer system appear to the unwanted code to be executing at least one of the virtual environment and the debugging environment when there is no virtual environment or debugging environment active.