al-khaser - Public malware techniques used in the wild: Virtua

项目说明

Al-Khaser v0.81

!Logo

Content

Introduction

Possible uses

Features

- Anti-debugging attacks
- Anti-Dumping
- Timing Attacks
- Human Interaction
- Anti-VM
- Anti-Disassembly

Requirements

License

Introduction

al-khaser is a PoC "malware" application with good intentions that aims to stress your anti-malware system.
It performs a bunch of common malware tricks with the goal of seeing if you stay under the radar.

!Logo

Usage

Download

You can download built binaries (x86, x64) from this project's releases page. The password for the 7zs can be found here.

Possible uses

You are making an anti-debug plugin and you want to check its effecti.

You want to ensure that your sandbox solution is hidden enough.

Or you want to ensure that your malware analysis en is well hidden.

Please, if you encounter any of the anti-analysis tricks which you have seen in a malware, don't hesitate to contribute.

Features

Anti-debugging attacks

IsDebuggerPresent

CheckRemoteDebuggerPresent

Process En Block (BeingDebugged)

Process En Block (NtGlobalFlag)

ProcessHeap (Flags)

ProcessHeap (ForceFlags)

Low Fragmentation Heap (LFH)

NtQueryInformationProcess (ProcessDebugPort)

NtQueryInformationProcess (ProcessDebugFlags)

NtQueryInformationProcess (ProcessDebugObject)

WudfIsAnyDebuggerPresent

WudfIsKernelDebuggerPresent

WudfIsUserDebuggerPresent

NtSetInformationThread (HideThreadFromDebugger)

NtQueryObject (ObjectTypeInformation)

NtQueryObject (ObjectAllTypesInformation)

CloseHanlde (NtClose) In Handle

SetHandleInformation (Protected Handle)

UnhandledExceptionFilter

OutputDebugString (GetLastError())

Hardware Breakpoints (SEH / GetThreadContext)

Software Breakpoints (INT3 / 0xCC)

Memory Breakpoints (PAGE_GUARD)

Interrupt 0x2d

Interrupt 1

Trap Flag

Parent Process (Explorer.exe)

SeDebugPri (Csrss.exe)

NtYieldExecution / SwitchToThread

TLS callbacks

Process jobs

Memory write watching

Page exception breakpoint detection

API hook detection (module bounds based)

Anti-injection

Enumerate modules with EnumProcessModulesEx (32-bit, 64-bit, and all options)

Enumerate modules with ToolHelp32

Enumerate the process LDR structures with LdrEnumerateLoadedModules

Enumerate the process LDR structures directly

Walk memory with GetModuleInformation

Walk memory for hidden modules

Anti-Dumping

Erase PE header from memory

SizeOfImage

Timing Attacks [Anti-Sandbox]

RDTSC (with CPUID to force a VM Exit)

RDTSC (Locky with GetProcessHeap & CloseHandle)

Sleep -> SleepEx -> NtDelayExecution

Sleep (in a loop a small delay)

Sleep and check if time was accelerated (GetTickCount)

SetTimer (Standard Windows Timers)

timeSetEvent (Multimedia Timers)

WaitForSingleObject -> WaitForSingleObjectEx -> NtWaitForSingleObject

WaitForMultipleObjects -> WaitForMultipleObjectsEx -> NtWaitForMultipleObjects

IcmpSendEcho (CCleaner Malware)

CreateWaitableTimer

CreateTimerQueueTimer

Big crypto loops (todo)

Human Interaction / Generic [Anti-Sandbox]

Mouse mo

File names like sample.exe or sandbox.exe.

Total Physical memory (GlobalMemoryStatusEx)

Disk size using De (IOCTL_DISK_GET_LENGTH_INFO)

Disk size using GetDiskFreeSpaceEx (TotalNumberOfBytes)

Mouse (Single click / Double click) (todo)

DialogBox (todo)

Scrolling (todo)

Execution after reboot (todo)

Count of processors (Win32/Tinba - Win32/Dyre)

Sandbox known product IDs (todo)

Color of background pixel (todo)

Keyboard layout (Win32/Banload) (todo)

Genuine Windows installation.

Known Sandbox hostnames and usernames

Anti- / Full-System Emulation

Registry key value artifacts

- HARDWARE\\DE\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0 (Identifier) (VBOX)
- HARDWARE\\DE\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0 (Identifier) (QEMU)
- HARDWARE\\Description\\System (SystemBios) (VBOX)
- HARDWARE\\Description\\System (SystemBios) (QEMU)
- HARDWARE\\Description\\System () ()
- HARDWARE\\Description\\System (SystemBiosDate) (06/23/99)
- HARDWARE\\DE\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0 (Identifier) ()
- HARDWARE\\DE\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0 (Identifier) ()
- HARDWARE\\DE\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0 (Identifier) ()
- SYSTEM\\ControlSet001\\Control\\SystemInformation (SystemManufacturer) ()
- SYSTEM\\ControlSet001\\Control\\SystemInformation (SystemProductName) ()

Registry Keys artifacts

- HARDWARE\\ACPI\\DSDT\\ (VBOX)
- HARDWARE\\ACPI\\FADT\\ (VBOX)
- HARDWARE\\ACPI\\RSDT\\ (VBOX)
- SOFTWARE\\Oracle\\ Guest Additions (VBOX)
- SYSTEM\\ControlSet001\\Services\\ (VBOX)
- SYSTEM\\ControlSet001\\Services\\ (VBOX)
- SYSTEM\\ControlSet001\\Services\\ (VBOX)
- SYSTEM\\ControlSet001\\Services\\ (VBOX)
- SYSTEM\\ControlSet001\\Services\\ (VBOX)
- SOFTWARE\\, Inc.\\ Tools ()
- SOFTWARE\\Wine (WINE)
- SOFTWARE\Microsoft\ Machine\Guest\Parameters (HYPER-V)
- SYSTEM\\CurrentControlSet\\Services\\Disk\\Enum
- SYSTEM\\CurrentControlSet\\Enum\\IDE
- SYSTEM\\CurrentControlSet\\Enum\\SCSI

File system artifacts

- "system32\\drivers\\.sys"
- "system32\\drivers\\.sys"
- "system32\\drivers\\.sys"
- "system32\\drivers\\.sys"
- "system32\\.dll"
- "system32\\.dll"
- "system32\\.dll"
- "system32\\.dll"
- "system32\\.dll"
- "system32\\.dll"
- "system32\\.dll"
- "system32\\.dll"
- "system32\\.dll"
- "system32\\.dll"
- "system32\\.exe"
- "system32\\.exe"
- "system32\\.exe"
- "system32\\drivers\\.sys"
- "system32\\drivers\\.sys"
- "system32\\drivers\\.sys"
- "system32\\drivers\\vmci.sys"
- "system32\\drivers\\.sys"
- "system32\\drivers\\.sys"
- "system32\\drivers\\.sys"
- "system32\\drivers\\.sys"
- "system32\\drivers\\.sys"

Directories artifacts

- "%PROGRAMFILES%\\oracle\\ guest additions\\"
- "%PROGRAMFILES%\\\\"

Memory artifacts

- Interupt Descriptor Table (IDT) location
- Local Descriptor Table (LDT) location
- Global Descriptor Table (GDT) location
- Task state segment trick with STR

MAC Address

- "\x08\x00\x27" (VBOX)
- "\x00\x05\x69" ()
- "\x00\x0C\x29" ()
- "\x00\x1C\x14" ()
- "\x00\x50\x56" ()
- "\x00\x1C\x42" (Parallels)
- "\x00\x16\x3E" (Xen)
- "\x0A\x00\x27" (Hybrid Analysis)

devices

- "\\\\.\\"
- "\\\\.\\"
- "\\\\.\\pipe\\"
- "\\\\.\\"
- "\\\\.\\pipe\\")
- "\\\\.\\HGFS"
- "\\\\.\\vmci"

Hardware Device information

- SetupAPI SetupDiEnumDe (GUID_DE)
- QEMU
-
- VBOX
- HD
- Power policies (S1-S4 states, thermal control)

System Firmware Tables

- SMBIOS string checks ()
- SMBIOS string checks ()
- SMBIOS string checks (Qemu)
- SMBIOS number of tables (Qemu, )
- ACPI string checks (WAET table, PNP devices, PM state with battery checks)
- ACPI string checks ()
- ACPI string checks ()
- ACPI string checks (Qemu)

Dri

-
-

Adapter name

-

Windows Class

-
-

Network shares

- Shared Folders

Processes

- .exe (VBOX)
- .exe (VBOX)
- .exe()
- .exe()
- ()
- .exe ()
- .exe ()
- .exe()
- .exe()
- prl_cc.exe(Parallels)
- prl_tools.exe(Parallels)
- xenservice.exe(Citrix Xen)
- qemu-ga.exe (QEMU)
- looking-glass-host.exe (GENERIC)
- .exe (GENERIC)

WMI

- SELECT * FROM Win32_Bios (SerialNumber) (GENERIC)
- SELECT * FROM Win32_PnPEntity (De) (VBOX)
- SELECT * FROM Win32_NetworkAdapterConfiguration (MACAddress) (VBOX)
- SELECT * FROM Win32_NTE (VBOX)
- SELECT * FROM Win32_Processor (NumberOfCores and ProcessorId) (GENERIC)
- SELECT * FROM Win32_LogicalDisk (Size) (GENERIC)
- SELECT * FROM Win32_ComputerSystem (Model and Manufacturer) (GENERIC)
- SELECT * FROM MSAcpi_ThermalZoneTemperature CurrentTemperature) (GENERIC)
- SELECT * FROM Win32_Fan (GENERIC)

DLL Exports and Loaded DLLs

- a.dll (AVG)
- a.dll (AVG)
- snxhk.dll (Avast)
- kernel32.dll!wine_get_unix_file_nameWine (Wine)
- sbiedll.dll (Sandboxie)
- dbghelp.dll (MS debugging support routines)
- api_log.dll (iDefense Labs)
- dir_watch.dll (iDefense Labs)
- pstorec.dll (SunBelt Sandbox)
- .dll ( PC)
- wpespy.dll (WPE Pro)
- cmdvrt32.dll (Comodo Container)
- cmdvrt64.dll (Comodo Container)

CPU

- Hypervisor presence using (EAX=0x1)
- Hypervisor using (EAX=0x40000000)
- "K\0\0\0" (KVM)
- "Microsoft Hv"(Microsoft Hyper-V or Windows PC)
- ""()
- "Xen"(Xen)
- "prl hyperv "( Parallels)
-""( )

NtQueryLicenseValue with Kernel- as license value.

Anti-Analysis

Processes

- OllyDBG / ImmunityDebugger / WinDbg / IDA Pro / X64dbg / Cheat Engine
- SysInternals Suite Tools (Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns)
- Wireshark / Dumpcap / Fiddler / Http Debugger
- ProcessHacker / SysAnalyzer / HookExplorer / SysInspector
- ImportREC / PETools / LordPE
- JoeBox Sandbox
- Resource Hacker
- Frida

Anti-Disassembly

Jump with constant condition

Jump instruction with same target

Impossible disassembly

Function Pointers

Return Pointer Abuse

Macro malware attacks

Document_Close / Auto_Close.

Application.RecentFiles.Count

Code/DLL Injections techniques

CreateRemoteThread

SetWindowsHooksEx

NtCreateThreadEx

RtlCreateUserThread

APC (QueueUserAPC / NtQueueApcThread)

RunPE (GetThreadContext / SetThreadContext)

Authors

Mattiwatti: Matthijs La

gsuberland: Graham Sutherland

hFireF0x: hfiref0x

Pull requests welcome. Please read the De Guidelines on our wiki if you wish to contribute to the project.

References

An Anti-Reverse Engineering Guide By Josh Jackson.

Anti-Unpacker Tricks By Peter Ferrie.

The Art Of Unpacking By Mark Yason.

Walied Assar's blog

Pafish tool:

PafishMacro by JoeSecurity:

项目信息

开发语言：C++

Star 数：7140

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。