4 Commits

Author	SHA1	Message	Date
chkp-aliaksandrt	010106480d	KVM: CPU Hypervisor and Vendor IDs check has been implemented ... Generic: BigRamAlloc has been added - tries to allocate big amount of RAM Generic: UserInputActivity has been added - evasion which utilizes `GetLastInputInfo` API function Generic: DiskEnum Registry Key chech has been added - checks `System\CurrentControlSet\Services\Disk\Enum` reg key for value `0`=`*virtual` Generic: Sandbox-like filename check has been added - checks if current file has any of the following patterns in its path: `C:\SELF.EXE`, `.*self\.*`, `.*sample.*`, `.*sandbox.*`, `.*virus.*`, `.*malware.*` Generic: Processes of AV and research tools check has been added - checks if any of the following processes are running: `avgui.exe`, `avastsvc.exe`, `avastui.exe`, `procmon.exe`, `procmon64.exe`, `procexp.exe`, `procexp64.exe`, `ollydbg.exe`, `windbg.exe`, `avp.exe`, `bdagent.exe`, `bdwtxag.exe`, `dwengine.exe` Generic: Max Processes number check has been added (disabled) Generic: Process with a long name check has been added Hyper-V: CPU HypervisorID check has been added Parallels: CPU HypervisorID check has been added QEMU: QEMU DiskEnum Registry Key has been added Sandboxie: Injected sbiedll module check has been added VMware: VMWare DiskEnum Registry Key check has been added Xen: CPU VendorID check has been added Xen: CPU HypervisorID check has been added Xen: DiskEnum Registry Key check has been added Some build warnings have been fixed	2019-01-02 17:45:51 +03:00
ar13l	d25dcc416c	Main: default mode (without parameters) executes Cuckoo Sandbox environment checks	2016-09-20 17:16:43 +03:00
ar13l	a36ca08119	JSON: tiny json implemented ... VEDetection: generic interface for reports grabbing and sandbox/virtual environments implemented Logger: simple logger implemented Cuckoo: implementation according to VEDetection interface Main: generic working modes parsing implemented	2016-08-26 13:06:39 +03:00
ar13l	0e8abc9037	Cuckoo: raised exceptions detection implemented ... Cuckoo: WMI escape implemented Cuckoo: detection by agent.py implemented Cuckoo: detection based on specific event presence implemented Cuckoo: whitelisted process detection implemented Cuckoo: reused pid detection implemented Cuckoo: configuration artifacts detection implemented Cuckoo: unbalanced stack detection implemented Cuckoo: INFINITE delay skip detection implemented Cuckoo: delays accumulation detection implemented Cuckoo: functions hooking detection implemented Cuckoo: agent.py artifacts detection implemented	2016-08-22 17:36:28 +03:00