Hiding Cuckoo from VM aware malware

cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system

http://www.cuckoosandbox.org

Other

5.56k stars 1.71k forks source link

Hiding Cuckoo from VM aware malware #896

Open macubergeek opened 8 years ago

macubergeek commented 8 years ago

Was hoping you could provide info/advice on this issue. My reading on this subject suggests modifying cuckoomon.dll code but the blog post dates to 2012. Was hoping you could provide advice in hiding VirtualBox from VM aware malware. I've been googling furiously and haven't found any current information.

doomedraven commented 8 years ago

@macubergeek https://github.com/nsmfoo/antivmdetection

jbremer commented 8 years ago

The anti VM detection script by Mikael is - or at least should be - a subset of what VMCloak is able to do. It definitely could be I haven't kept up with the latest changes, but due to its great functionality I try to keep VMCloak up-to-date; which tries to provide all this functionality plus some more.