26 Commits

Author SHA1 Message Date
chkp-alexeybu d6fa72cb4d Cuckoo: check for invalid hook of NtLoadKeyEx added
Cuckoo: lack of argument checks in NtDelayExecution evasion added
2022-02-07 14:22:33 +03:00
chkp-aliaksandrt 010106480d KVM: CPU Hypervisor and Vendor IDs check has been implemented
Generic: BigRamAlloc has been added - tries to allocate big amount of RAM
Generic: UserInputActivity has been added - evasion which utilizes `GetLastInputInfo` API function
Generic: DiskEnum Registry Key chech has been added - checks `System\CurrentControlSet\Services\Disk\Enum` reg key for value `0`=`*virtual`
Generic: Sandbox-like filename check has been added - checks if current file has any of the following patterns in its path: `C:\SELF.EXE`, `.*self\.*`, `.*sample.*`, `.*sandbox.*`, `.*virus.*`, `.*malware.*`
Generic: Processes of AV and research tools check has been added - checks if any of the following processes are running: `avgui.exe`, `avastsvc.exe`, `avastui.exe`, `procmon.exe`, `procmon64.exe`, `procexp.exe`, `procexp64.exe`, `ollydbg.exe`, `windbg.exe`, `avp.exe`, `bdagent.exe`, `bdwtxag.exe`, `dwengine.exe`
Generic: Max Processes number check has been added (disabled)
Generic: Process with a long name check has been added
Hyper-V: CPU HypervisorID check has been added
Parallels: CPU HypervisorID check has been added
QEMU: QEMU DiskEnum Registry Key has been added
Sandboxie: Injected sbiedll module check has been added
VMware: VMWare DiskEnum Registry Key check has been added
Xen: CPU VendorID check has been added
Xen: CPU HypervisorID check has been added
Xen: DiskEnum Registry Key check has been added
Some build warnings have been fixed
2019-01-02 17:45:51 +03:00
Alexey Bukhteyev 02ea69cff4 Cuckoo: ResultserverConnection detection technique implemented 2018-04-10 11:02:48 +03:00
Stanislav Skuratovich 46ca97a51d Generic: raw mouse activity check implemented 2017-08-04 17:27:04 +03:00
Stanislav Skuratovich d67a70942d Cuckoo: SocketTimeout detection technique implemented
VEDetection: generic interface for drive model vendor added
2017-08-03 15:04:53 +03:00
Stanislav Skuratovich 4732ecd14e OpenProcess condition bug fix 2017-03-03 12:57:26 +03:00
ar13l 01552597f4 Cuckoo: TickCount integrity check cast bug fixed 2017-01-24 14:24:29 +03:00
ar13l 82597eb731 Cuckoo: TickCount integrity check implemented 2017-01-19 16:20:24 +03:00
ar13l b3170a3d71 Cuckoo: DelayInterval detection technique implemented 2017-01-19 11:51:07 +03:00
ar13l 3defb69b57 Cuckoo: SuspendedThread evasion technique implemented 2017-01-09 13:17:28 +03:00
ar13l 5372b543d2 Cuckoo: Dead Analyzer evasion technique implemented 2017-01-06 19:56:22 +03:00
ar13l 43dd12b54a Cuckoo: differentiation between real and sandbox machines implemented while performing evasions (function hooks are used). If hooks are fixed. then another method should be used. 2017-01-06 17:39:08 +03:00
ar13l 215fbe6ad9 Cuckoo: moving date/time tampering technique to Generic 2016-10-03 13:29:45 +03:00
ar13l 90c6913187 Cuckoo: delays accumulation detection technique reimplemented 2016-09-28 17:59:02 +03:00
ar13l 5bfa26a4b9 Cuckoo: detection by configuration file technique reimplemented 2016-09-28 15:26:51 +03:00
ar13l c871f84df5 Cuckoo: EXCEPTION_MAXCOUNT adopted 2016-09-02 11:10:25 +03:00
ar13l 57c91d81bc Cuckoo: time tampering sandbox detection method implemented 2016-08-31 17:51:48 +03:00
ar13l 0f4ae91f37 Logger: colored console implemented
Main: banner added
2016-08-30 19:55:27 +03:00
ar13l 14fc80d815 Config: enabled field added 2016-08-30 15:45:35 +03:00
ar13l dde47d8946 VEDetection: generic interface for the registries, files, devices, processes checks implemented
VMWare: implementation of detection techniques using VEDetection interface
Config: new fields added
2016-08-29 17:00:27 +03:00
ar13l a36ca08119 JSON: tiny json implemented
VEDetection: generic interface for reports grabbing and sandbox/virtual environments implemented
Logger: simple logger implemented
Cuckoo: implementation according to VEDetection interface
Main: generic working modes parsing implemented
2016-08-26 13:06:39 +03:00
ar13l 42db85cc14 Cuckoo: raised exceptions detection handling 2016-08-25 12:36:01 +03:00
ar13l 2998c43f71 Cuckoo: Agent presence detection timeout for network operations added 2016-08-24 17:14:33 +03:00
ar13l 9260563277 Cuckoo: WMI OpenProcess flag changed to PROCESS_QUERY_INFORMATION 2016-08-24 14:45:58 +03:00
ar13l 73c1db7360 Cuckoo: Task Scheduler escape implemented (Windows Vista and upper) 2016-08-24 12:06:52 +03:00
ar13l 0e8abc9037 Cuckoo: raised exceptions detection implemented
Cuckoo: WMI escape implemented
Cuckoo: detection by agent.py implemented
Cuckoo: detection based on specific event presence implemented
Cuckoo: whitelisted process detection implemented
Cuckoo: reused pid detection implemented
Cuckoo: configuration artifacts detection implemented
Cuckoo: unbalanced stack detection implemented
Cuckoo: INFINITE delay skip detection implemented
Cuckoo: delays accumulation detection implemented
Cuckoo: functions hooking detection implemented
Cuckoo: agent.py artifacts detection implemented
2016-08-22 17:36:28 +03:00