al-khaser

Al-Khaser v0.81 Contenido Introducción Posibles usos Características Ataques anti-debugging Anti-Dumping Ataques de temporización Interacción Humana Anti-VM Anti-Desensamblado Requisitos Licencia Introducción al-khaser es una aplicación de "malware" PoC con buenas intenciones que tiene como...

crypter

Crypter Este Crypter está escrito en Python 3, y se puede utilizar para ofuscar y cifrar el código fuente de Python para eludir el antivirus. También es capaz de eludir máquinas virtuales como VirtualBox, VMware y Sandboxie. Utiliza cifrado AES de 256 bits y codificación Base64 para cifrar el...

CVE-2023-33668

CVE-2023-33668 Summary DigiExam is a surveillance exam and proctoring software. The software is installed in schools' or students' computers. When the student joins an exam, DigiExam will: ensure it's not running in a Virtual Machine, terminate all applications, fullscreen itself, and prevent the...

VMDragonSlayer

VMDragonSlayer El proyecto será público a mediados de octubre Refactorización en progreso Marco avanzado de detección y análisis de máquinas virtuales VMDragonSlayer es un marco integral para analizar binarios protegidos por protectores basados en Máquinas Virtuales VM como VMProtect 2.x/3.x,...

VBoxCloak

VBoxCloak Un script de PowerShell que intenta ayudar a los analistas de malware a ocultar sus máquinas virtuales Windows de VirtualBox de malware que pueda estar intentando evadir el análisis. Garantizado para reducir tus puntuaciones de pafish al menos unos cuantos puntos ; El script logra esto...

fake-sandbox

Procesos Falsos de Sandbox FSP Este pequeño script simulará procesos falsos de software de análisis, sandbox y máquinas virtuales que algunos malware intentarán evitar. Puedes descargar el script original creado por @x0rz aquí gracias, por cierto. También puedes descargar mi script ligeramente...

invoke-antivm

Invoke-AntiVM v1.0 Introducción Invoke-AntiVM es un conjunto de módulos para realizar detección y huella digital de máquinas virtuales con exfiltración a través de PowerShell. Compatibilidad Ejecute el script check-compatibility.ps1 para verificar qué módulos o funciones son compatibles con la...

AntiDebug-AntiVM

AntiDebug/AntiVM Purpose This repository hosts the different debug/vm detection methods I have come across whilst looking through the WinAPI. This is not intended to be compiled and ran but rather to show examples of how to implement these different methods into your existing projects. Each file ...

VMwareCloak

VMwareCloak A PowerShell script that attempts to help malware analysts hide their VMware Windows VM's from malware that may be trying to evade analysis. Guaranteed to bring down your pafish ratings by at least a few points ; The script accomplishes this by doing the following: Renames several...

pafish

Pafish Pafish es una herramienta de prueba que utiliza diferentes técnicas para detectar máquinas virtuales y entornos de análisis de malware, de la misma manera que lo hacen las familias de malware. El proyecto es gratuito y de código abierto; el código de todas las técnicas de anti-análisis est...

Malicious code in zip-me (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4ae48b0e5e3d93cee49e83f0bfa47a43f02ede60914545d0d82204c6664fde6f During installation, the package collects quite extensive information about the host and has no other purpose. To avoid detection, the real code is put in a ZI...

The forgotten malvertising campaign

In recent weeks, we have noted an increase in malvertising campaigns via Google searches. Several of the threat actors we are tracking have improved their techniques to evade detection throughout the delivery chain. We believe this evolution will have a real world impact among corporate users...

Fedora: Security Advisory for golang-github-shellcode33-vm-detection (FEDORA-2022-37aef44d1e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: golang-github-shellcode33-vm-detection-0-0.7.20200715git4fd05cb.fc36

Linux and Windows VMs evasion fully written in Go...

Fedora: Security Advisory for golang-github-shellcode33-vm-detection (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: golang-github-shellcode33-vm-detection-0-0.6.20200715git4fd05cb.fc35

Linux and Windows VMs evasion fully written in Go...

Fedora: Security Advisory for golang-github-shellcode33-vm-detection (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Gootkit: the cautious Trojan

Gootkit is complex multi-stage banking malware that was discovered for the first time by Doctor Web in 2014. Initially it was distributed via spam and exploits kits such as Spelevo and RIG. In conjunction with spam campaigns, the adversaries later switched to compromised websites where the visito...

CB TAU Threat Intelligence Notification – Karagany Malware

Secureworks recently reported in regards to an update of Karagany malware last month. The malware is used by the IRON LIBERTY threat group also known as DragonFly2.0 and Energetic Bear, targeting energy companies and organizations. Carbon Black Threat Analysis Unit TAU provides the product rules ...

CrackMeJ1

This is a multi-staged crackme that implements several protections for antidebugging. Objective: Find the keys 3 to solve the crackme and make a keygen Hint: Run it on a VM :- / Crack Me by jSacco // This crack me uses antidebugging techniques such as: VM Detection , Traps and IsDebuggerPresent /...