hatching / vmcloak

Automated Virtual Machine Generation and Cloaking for Cuckoo Sandbox.
483 stars 120 forks source link

Change Python EXEs to randomized names during installation #158

Open scrublullz opened 5 years ago

scrublullz commented 5 years ago

Some malware has been looking for a process name containing python on machines as a kill switch. If encountered, the malware shuts down before fully decoding.

I have been able to circumvent this by giving the executables random names for the python binaries.