8a2f1e89a8
Added CreateWaitableTimer and CreateTimerQueueTimer checks.
...
These are basic checks for now. They just see if the API calls succeed or fail. In future we should probably use a secondary timing check alongside it to get a better idea about time acceleration.
2018-07-10 19:08:41 +01:00
4b71d41bdf
Added power capabilities checks.
...
The GetPwrCapabilities API can be used to test for certain power capabilities of the system. Most VMs don't support CPU power states S1-S4 or thermal control
2018-05-28 20:27:51 +01:00
8308255641
Added Anti-VM check using WMI (Select ProcessorId from Win32_Processor) used by (GravityRAT)
2018-04-30 13:12:24 +02:00
a175d18320
Added Anti-VM check for current CPU temperature using WMI (Select CurrentTemperature from MSAcpi_ThermalZoneTemperature) used by (GravityRAT)
2018-04-27 21:26:42 +02:00
8cb2ffc1e6
Added Anti-VM check which look for MAC address (Paralles and Xen) used by (GravityRAT)
2018-04-27 13:06:46 +02:00
c8e52d9e91
Added Anti-VM check using WMI (Select Model/Manufacturer from Win32_ComputerSystem) used by (GravityRAT)
2018-04-27 11:34:07 +02:00
6628e55729
Added Hyper-V/VirtualPC anti-VM checks (GravityRAT)
2018-04-27 10:10:56 +02:00
135e50f313
Added firmware table checks SMBIOS and ACPI (Qemu)
2018-04-24 19:09:54 +02:00
338857ebee
added qemu process check (qemu-ga.exe)
2018-04-23 20:26:06 +02:00
a329f854e9
add some macros to enable/disable category for checks to easy debugging
2018-03-14 21:47:50 +01:00
daf7077dc0
add anti-vm check for vmware using system firmware tables
2018-03-14 21:41:44 +01:00
fc694d07fe
Add more checks for VMware related processes
2018-02-28 20:09:27 +01:00
1179c52761
Add checks for VMware related files
2018-02-28 20:06:26 +01:00
9611c7d55f
add two regsitry key values check for VMWare
2018-02-28 19:48:25 +01:00
98b1ceb172
add more laoded dlls check: avghookx, avghooka, snxhk
2018-02-28 19:44:48 +01:00
859651e837
Merge pull request #101 from gsuberland/write-watch
...
Memory write watch anti-debug
2018-01-26 18:49:16 +01:00
d5e695c5d1
Merge pull request #100 from gsuberland/services
...
VM driver service checks
2018-01-26 15:01:34 +01:00
14b1a5dce5
Added memory write watching to readme.
2018-01-24 23:34:16 +00:00
ee92ff820b
Added driver services to readme
2018-01-24 22:48:08 +00:00
439ca6ccd5
Bug fix: ascii_to_wide_str() wrong argument
2017-12-19 18:33:43 +01:00
b6b2a57159
credit contributors and bump version
2017-12-12 08:50:16 +01:00
822d88c02e
Removing erroenous README spaces introduced in last commit.
2017-11-24 09:47:32 +00:00
4bc329b7ad
Formatting bullet points in README
2017-11-24 09:44:47 +00:00
6bdfe4caaa
Added system firmware tables to README
2017-11-24 09:39:29 +00:00
ec654c504d
Added process jobs to README + minor spelling/grammar fixes
2017-11-21 23:02:38 +00:00
2fea11a2b8
fix version
2017-09-18 22:38:42 +02:00
d34a5c97d9
add IcmpSendEcho timing attack seen in Ccleaner malware
2017-09-18 22:37:27 +02:00
21863472ca
thanks to JoeSecurity for pafishMacro
2017-09-18 21:50:39 +02:00
bed4c48eea
Add support for macro based sandbox detection tricks: AutoClose and Recent document count
2017-03-20 19:01:26 +01:00
16156aad3d
update image
2017-01-31 17:44:10 +01:00
ed1427f983
add Hypervisor CPUID EAX=1 presence flag and fix previous commit
2017-01-31 17:41:00 +01:00
e645e2fd3f
add cpuid vendor id check - hypervisor detection
2017-01-31 16:32:00 +01:00
47fd13090c
add timing attack: rdtsc with cpuid (VM Exit)
2017-01-17 13:45:26 +01:00
383795ea88
add TLS callback trick
2017-01-11 11:43:58 +01:00
6ca3761e9e
check time if it was patched
2016-10-31 20:14:42 +01:00
049a40c844
add disk size check using GetDiskFreeSpace - generic sandbox detection
2016-10-28 18:46:12 +02:00
8970609ab4
add disk size space using IoDeviceControl
2016-10-21 20:42:44 +02:00
b101fe3bae
fix reg key valye in vbox detection
2016-10-21 11:36:42 +02:00
be4391448d
Merge pull request #64 from LordNoteworthy/Noteworthy
...
memory space check
2016-10-20 19:38:46 +02:00
156c384290
memory space check
2016-10-20 19:38:06 +02:00
be977324f9
Merge pull request #63 from LordNoteworthy/Noteworthy
...
add mouse movement trick
2016-10-20 19:03:51 +02:00
fbcb4c5b76
add mouse movement trick
2016-10-20 19:02:24 +02:00
9a5d4d2e97
Update README.md
2016-10-20 15:54:57 +02:00
6674d36dc2
add screenshot and compiled binary
2016-10-20 15:51:13 +02:00
37084c15ad
add sleep in a loop
2016-08-02 14:55:10 +02:00
e2770bf9c6
output cleanup
2016-08-02 13:11:22 +02:00
55d2abf42b
add setupdi_diskdrive anti-vm trick + main cleanup
2016-08-02 13:02:23 +02:00
0ec092e12f
add hard disk check using WMI
2016-08-01 22:07:23 +02:00
a4dae5e03f
add cores number check from WMI
2016-07-26 21:01:56 +02:00
8e6148cd24
add task state segment trick via STR
2016-07-17 12:55:01 +02:00
Graham Sutherland