I’m not aware of any steps security researches take to obscure the fact they are running in a VM from malware.