PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Malware development part 2 - anti dynamic analysis & sandboxes

0xpat.github.io | blog | #red-team | #malware-development | #evasion | #anti-analysis | #sandbox-detection | #virtual-machine
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Malware dev part 2: sandbox and VM detection for dynamic-analysis evasion—fingerprinting limited resources, indicative device names and artifacts to tell real hosts from analysis environments.
Published
Collected

Related coverage

blog · 0xpat.github.io
Malware development part 6 - advanced obfuscation with LLVM and template metaprogramming
Malware development part 6: anti-disassembly obfuscation with Obfuscator-LLVM—how IR-level transforms and template metaprogramming hide control flow, plus the VS2017 build setup.
blog · 0xpat.github.io
Malware development part 3 - anti-debugging
Part 3 of the malware dev series: detecting debuggers via IsDebuggerPresent, PEB flags, NtQueryInformationProcess artifacts and breakpoint checks—plus tricks to hinder manual analysis.
blog · bishopfox.com
Rust for Malware Development
Bishop Fox compares Rust and C/C++ for malware: larger, harder-to-analyze binaries complicate reverse engineering and can slip past signature detection — demonstrated with a simple shellcode dropper.
blog · 0xpat.github.io
Malware development part 9 - hosting CLR and managed code injection
Malware development part 9: executing managed .NET assemblies from native code—hosting the CLR via ICLRRuntimeHost/ICorRuntimeHost, and running payloads from memory rather than disk.
blog · 0xpat.github.io
Malware development part 8 - COFF injection and in-memory execution
Part 8 of the malware dev series: a COFF object-file loader à la Cobalt Strike's BOFs—compiling C to .obj, parsing headers, sections and relocations, then executing the machine code from memory.
blog · 0xpat.github.io
Malware development part 7 - Secure Desktop keylogger
Part 7 of the malware dev series builds a Secure Desktop keylogger: after escalating to SYSTEM, a low-level keyboard hook on the WINLOGON desktop captures credentials typed into UAC and logon prompts.
Back