 ar13l
|
c871f84df5
|
Cuckoo: EXCEPTION_MAXCOUNT adopted
|
2016-09-02 11:10:25 +03:00 |
|
|
ar13l
|
a8a12105ff
|
VEDetection: generic interface for the disks checks implemented
|
2016-09-01 18:15:12 +03:00 |
|
|
ar13l
|
2b1ecfbb58
|
Report: field Type added
Generic: dummy sleep patch bug fixed
|
2016-09-01 17:29:23 +03:00 |
|
|
ar13l
|
15a9201c4b
|
VEDetection: generic interface for the hared folders checks implemented
VBOX: detection techniques added
VMware: detection techniques added
|
2016-09-01 15:35:30 +03:00 |
|
|
ar13l
|
1088bd53b9
|
VEDetection: generic interface for the windows checks implemented
|
2016-09-01 14:52:11 +03:00 |
|
|
ar13l
|
65a6c16892
|
VMware: adding additional vm checks
|
2016-09-01 14:10:02 +03:00 |
|
|
ar13l
|
2bc45c73de
|
Config: recursive field added
|
2016-09-01 13:33:34 +03:00 |
|
|
ar13l
|
48ce0d7feb
|
Config: value_name now support arrays
Code: refactoring
|
2016-09-01 12:09:24 +03:00 |
|
|
ar13l
|
56e34346d3
|
VEDetection: generic interface for cpuid vendor check implemented
|
2016-08-31 20:17:15 +03:00 |
|
|
ar13l
|
5d97a619e1
|
VEDetection: generic interface for cpuid vendor check implemented
|
2016-08-31 20:16:15 +03:00 |
|
|
ar13l
|
7058e497f3
|
Generic: DNS response check implemented
|
2016-08-31 18:59:37 +03:00 |
|
|
ar13l
|
57c91d81bc
|
Cuckoo: time tampering sandbox detection method implemented
|
2016-08-31 17:51:48 +03:00 |
|
|
ar13l
|
99ec56f37b
|
Generic: implementation of detection techniques using VEDetection interface
|
2016-08-31 16:46:01 +03:00 |
|
|
ar13l
|
90a15e6999
|
VEDetection: Report module is used now for the report generation
|
2016-08-31 13:35:29 +03:00 |
|
|
ar13l
|
0b06377a0e
|
Report: dummy module that is responsible for HTML report generation implemented
|
2016-08-31 12:47:41 +03:00 |
|
|
ar13l
|
0f4ae91f37
|
Logger: colored console implemented
Main: banner added
|
2016-08-30 19:55:27 +03:00 |
|
|
ar13l
|
065ba141bf
|
VBOX: implementation of detection techniques using VEDetection interface
|
2016-08-30 18:16:29 +03:00 |
|
|
ar13l
|
d7c9b96ab0
|
VEDetection: generic interface for directory objects checks implemented
|
2016-08-30 17:00:26 +03:00 |
|
|
ar13l
|
14fc80d815
|
Config: enabled field added
|
2016-08-30 15:45:35 +03:00 |
|
|
ar13l
|
515f51ae2b
|
VEDetection: VEDetection: generic interface for different firmware types checks implemented
VMWare: custom checks implemented (port, NDIS_WanIP)
|
2016-08-30 14:32:49 +03:00 |
|
|
ar13l
|
9c5b1f306c
|
Config: support for different registry types added
|
2016-08-29 21:48:49 +03:00 |
|
|
ar13l
|
1ee0ab8958
|
VEDetection: generic interface for the adapters check implemented
|
2016-08-29 20:38:57 +03:00 |
|
|
ar13l
|
434b4cf75e
|
Helper: fixing bug when 32-bit process on 32-bit OS fails due to unavailable fs redirection
|
2016-08-29 20:22:13 +03:00 |
|
|
ar13l
|
781dd4b5e8
|
Config: support for arrays added
|
2016-08-29 20:11:18 +03:00 |
|
|
ar13l
|
7ff1d39584
|
VEDetection: generic interface for the macs check implemented
|
2016-08-29 19:26:27 +03:00 |
|
|
ar13l
|
dde47d8946
|
VEDetection: generic interface for the registries, files, devices, processes checks implemented
VMWare: implementation of detection techniques using VEDetection interface
Config: new fields added
|
2016-08-29 17:00:27 +03:00 |
|
|
ar13l
|
a36ca08119
|
JSON: tiny json implemented
VEDetection: generic interface for reports grabbing and sandbox/virtual environments implemented
Logger: simple logger implemented
Cuckoo: implementation according to VEDetection interface
Main: generic working modes parsing implemented
|
2016-08-26 13:06:39 +03:00 |
|
|
ar13l
|
42db85cc14
|
Cuckoo: raised exceptions detection handling
|
2016-08-25 12:36:01 +03:00 |
|
|
ar13l
|
2998c43f71
|
Cuckoo: Agent presence detection timeout for network operations added
|
2016-08-24 17:14:33 +03:00 |
|
|
ar13l
|
9260563277
|
Cuckoo: WMI OpenProcess flag changed to PROCESS_QUERY_INFORMATION
|
2016-08-24 14:45:58 +03:00 |
|
|
ar13l
|
6db40683e7
|
boost LICENSE added
|
2016-08-24 12:08:06 +03:00 |
|
|
ar13l
|
73c1db7360
|
Cuckoo: Task Scheduler escape implemented (Windows Vista and upper)
|
2016-08-24 12:06:52 +03:00 |
|
|
ar13l
|
0e8abc9037
|
Cuckoo: raised exceptions detection implemented
Cuckoo: WMI escape implemented
Cuckoo: detection by agent.py implemented
Cuckoo: detection based on specific event presence implemented
Cuckoo: whitelisted process detection implemented
Cuckoo: reused pid detection implemented
Cuckoo: configuration artifacts detection implemented
Cuckoo: unbalanced stack detection implemented
Cuckoo: INFINITE delay skip detection implemented
Cuckoo: delays accumulation detection implemented
Cuckoo: functions hooking detection implemented
Cuckoo: agent.py artifacts detection implemented
|
2016-08-22 17:36:28 +03:00 |
|
|
ar13l
|
ecd5593557
|
CHANGELOG added
|
2016-08-22 17:24:04 +03:00 |
|
|
MalwareResearch
|
4d717c553a
|
Initial commit
|
2016-06-10 16:01:05 +03:00 |
|