There's a malware trick I'd read about but never witnessed firsthand: a trojan that checks whether it's connected to the real internet before doing anything malicious. If it detects a sandbox — no internet, wrong hardware, a debugger slowing it down — it goes quiet.
So for a graduate malware analysis project, I decided to give it a real internet. A fake one.
This is a walkthrough of how I analyzed FlexenseActivator.exe — a trojan disguised as a software activation tool — inside a fully isolated two-VM lab. I'll explain what the malware does, how I caught it doing it, and what any of this means for defenders.
The Sample
File: FlexenseActivator.exe
