A malware detection system to detect malware in a virtual machine (VM), the system including a profile generator adapted to generate a profile of a deployment of the VM, the profile including execution characteristics of the deployment; a VM package generator to generate a VM package including: a VM descriptor describing a particular deployment of the VM; and an image of the particular deployment, the image including a representation of data stored for the particular deployment of the VM; and a malware identifier adapted to identify malware in a deployment of the VM responsive to the identification of a difference between profiles of multiple different deployments of the VM.