 Stanislav Skuratovich
|
54516d034b
|
Generic: DNS response check servers changed
Generic: PerformanceCounter detection technique implemented
|
2017-08-03 18:28:50 +03:00 |
|
|
Stanislav Skuratovich
|
d67a70942d
|
Cuckoo: SocketTimeout detection technique implemented
VEDetection: generic interface for drive model vendor added
|
2017-08-03 15:04:53 +03:00 |
|
|
Stanislav Skuratovich
|
4732ecd14e
|
OpenProcess condition bug fix
|
2017-03-03 12:57:26 +03:00 |
|
|
ar13l
|
01552597f4
|
Cuckoo: TickCount integrity check cast bug fixed
|
2017-01-24 14:24:29 +03:00 |
|
|
ar13l
|
82597eb731
|
Cuckoo: TickCount integrity check implemented
|
2017-01-19 16:20:24 +03:00 |
|
|
ar13l
|
b3170a3d71
|
Cuckoo: DelayInterval detection technique implemented
|
2017-01-19 11:51:07 +03:00 |
|
|
MalwareResearch
|
dcec8b7d1a
|
Adding ShmooCon 2017 to presentations list
|
2017-01-18 15:08:23 +03:00 |
|
|
ar13l
|
774b5cc6dd
|
New slides added
|
2017-01-18 14:56:55 +03:00 |
|
|
MalwareResearch
|
da906a1e90
|
Adjusted repository name, links and credits
|
2017-01-11 16:29:28 +03:00 |
|
|
ar13l
|
8b60a13fde
|
VEDetection: DNS module domain composition changed
|
2017-01-10 14:32:05 +03:00 |
|
|
ar13l
|
5231ee6e96
|
VMWare: i/o ports detection implemented
|
2017-01-10 13:31:42 +03:00 |
|
|
ar13l
|
e70f52d728
|
VEDetection: generic interface for drive model implemented
|
2017-01-09 18:02:15 +03:00 |
|
|
ar13l
|
3defb69b57
|
Cuckoo: SuspendedThread evasion technique implemented
|
2017-01-09 13:17:28 +03:00 |
|
|
ar13l
|
5372b543d2
|
Cuckoo: Dead Analyzer evasion technique implemented
|
2017-01-06 19:56:22 +03:00 |
|
|
ar13l
|
43dd12b54a
|
Cuckoo: differentiation between real and sandbox machines implemented while performing evasions (function hooks are used). If hooks are fixed. then another method should be used.
|
2017-01-06 17:39:08 +03:00 |
|
|
MalwareResearch
|
50ba964057
|
Update README.md
|
2017-01-04 17:21:20 +03:00 |
|
|
MalwareResearch
|
d3d6a9cc91
|
Logo file added
|
2017-01-04 15:58:46 +03:00 |
|
|
ar13l
|
8a1b52c640
|
Uninitialized dns_interface variable bug fixed
|
2016-12-22 16:01:12 +03:00 |
|
|
ar13l
|
78c0eb8a27
|
Detect by Wireshark device moved to Generic
|
2016-12-22 12:00:26 +03:00 |
|
|
ariel19
|
2f7c27f38e
|
VEDetection: DNS module is used now for user notification about detection technique result
|
2016-12-21 15:19:30 +03:00 |
|
|
MalwareResearch
|
381d2ea96d
|
Update README.md
|
2016-10-13 15:40:01 +03:00 |
|
|
MalwareResearch
|
e2f809661f
|
Slides from Virus Bulletin 2016 conference link added
|
2016-10-10 14:37:05 +03:00 |
|
|
ar13l
|
f7f9b2e452
|
VB2016 slides added
|
2016-10-10 14:27:49 +03:00 |
|
|
MalwareResearch
|
96b973326f
|
Update README.md
|
2016-10-06 09:21:31 -06:00 |
|
|
MalwareResearch
|
bcbce3f150
|
Update README.md
|
2016-10-05 23:44:09 +03:00 |
|
|
MalwareResearch
|
21627d2401
|
Update README.md
|
2016-10-05 23:29:22 +03:00 |
|
|
ar13l
|
45ff60b4f3
|
Original parameters for debugging purpose restored
|
2016-10-03 13:36:18 +03:00 |
|
|
ar13l
|
215fbe6ad9
|
Cuckoo: moving date/time tampering technique to Generic
|
2016-10-03 13:29:45 +03:00 |
|
|
ar13l
|
b38f519dcf
|
DEBUG configuration removed
|
2016-09-29 18:15:52 +03:00 |
|
|
ar13l
|
39e2ff7b54
|
Fixing bug that occurs while compiling in DEBUG mode
|
2016-09-29 17:59:51 +03:00 |
|
|
ar13l
|
a1e0e32ec0
|
Config: detection/evasion techniques description added
|
2016-09-29 17:11:43 +03:00 |
|
|
ar13l
|
90c6913187
|
Cuckoo: delays accumulation detection technique reimplemented
|
2016-09-28 17:59:02 +03:00 |
|
|
ar13l
|
5bfa26a4b9
|
Cuckoo: detection by configuration file technique reimplemented
|
2016-09-28 15:26:51 +03:00 |
|
|
ar13l
|
0d7c0d5028
|
Main: report is generated in case of configuration files absence during execution
|
2016-09-20 18:42:08 +03:00 |
|
|
ar13l
|
d25dcc416c
|
Main: default mode (without parameters) executes Cuckoo Sandbox environment checks
|
2016-09-20 17:16:43 +03:00 |
|
|
ar13l
|
4a9c5218a0
|
VEDetection: File module is now writes bytes to detection file in order to be visible in behavioral analysis
|
2016-09-20 15:11:01 +03:00 |
|
|
ar13l
|
98594dea9b
|
VEDetection: File module is used now for user notification about detection technique result
|
2016-09-19 13:22:24 +03:00 |
|
|
ar13l
|
5caf598a1f
|
Report placeholders' changes
|
2016-09-19 11:32:59 +03:00 |
|
|
ar13l
|
c871f84df5
|
Cuckoo: EXCEPTION_MAXCOUNT adopted
|
2016-09-02 11:10:25 +03:00 |
|
|
ar13l
|
a8a12105ff
|
VEDetection: generic interface for the disks checks implemented
|
2016-09-01 18:15:12 +03:00 |
|
|
ar13l
|
2b1ecfbb58
|
Report: field Type added
Generic: dummy sleep patch bug fixed
|
2016-09-01 17:29:23 +03:00 |
|
|
ar13l
|
15a9201c4b
|
VEDetection: generic interface for the hared folders checks implemented
VBOX: detection techniques added
VMware: detection techniques added
|
2016-09-01 15:35:30 +03:00 |
|
|
ar13l
|
1088bd53b9
|
VEDetection: generic interface for the windows checks implemented
|
2016-09-01 14:52:11 +03:00 |
|
|
ar13l
|
65a6c16892
|
VMware: adding additional vm checks
|
2016-09-01 14:10:02 +03:00 |
|
|
ar13l
|
2bc45c73de
|
Config: recursive field added
|
2016-09-01 13:33:34 +03:00 |
|
|
ar13l
|
48ce0d7feb
|
Config: value_name now support arrays
Code: refactoring
|
2016-09-01 12:09:24 +03:00 |
|
|
ar13l
|
56e34346d3
|
VEDetection: generic interface for cpuid vendor check implemented
|
2016-08-31 20:17:15 +03:00 |
|
|
ar13l
|
5d97a619e1
|
VEDetection: generic interface for cpuid vendor check implemented
|
2016-08-31 20:16:15 +03:00 |
|
|
ar13l
|
7058e497f3
|
Generic: DNS response check implemented
|
2016-08-31 18:59:37 +03:00 |
|
|
ar13l
|
57c91d81bc
|
Cuckoo: time tampering sandbox detection method implemented
|
2016-08-31 17:51:48 +03:00 |
|