At least one malware crew even setup a specific C&C server for researchers. The malware still would install correctly if detected a VM but it would use a different domain generation algorithm that would connect to a completely different infrastructure than the one used for regular infections. This is very difficult to notice as the behavior is no different than what you would expect from a regular infection. http://malware.dontneedcoffee.com/2016/04/bedepantiVM.html