1

I'm learning malware analysis. I'm looking for malware samples that terminate themselves when recognize working on a VM or sandbox.

Thanks.

4
  • This relates to reverseengineering.stackexchange.com/questions/206/…
    – NirIzr
    Sep 19, 2016 at 22:36
  • I propose having a look at early cerber samples (9e82344a0a854411fd095f070b0782e8), they feature a debug mode, few obfuscation tricks and the whole range of basic anti-vm-techniques (have a look at 0x401307)
    – Nordwald
    Sep 20, 2016 at 5:02
  • @Nordwald Do you know where I can download these samples of cerber? (I have tried searching with the given hash but cannot found any) May 4, 2017 at 7:55
  • @TaThanhDinh This is only the hash of a sample I analyzed personally, but any of the early-samples should suffice as an example. Sadly, apart from commercial solutions like VirusTotal, malware repositories are awfully bad maintained. You may try malpedia or openMalware for example
    – Nordwald
    May 4, 2017 at 12:04

2 Answers 2

6

For learning purposes, I would recommend you the following Github projects to start with:

Paranoid Fish by a0rtega

https://github.com/a0rtega/pafish

Al-Khaser v0.60 by Noteworthy

https://github.com/LordNoteworthy/al-khaser

or

Colection by AlicanAkyol

https://github.com/AlicanAkyol/sems

Grab one you like, compile and analyze.

In case you look for in the wild samples, you should look at Andromeda\Gamarue bot. It have a plenty of anti tricks, including anti-VM, anti-Sandbox, anti-research etc.

1

https://github.com/a0rtega/pafish is old but it is good tool. https://github.com/AlicanAkyol/sems is current. You can use it.

2
  • 1
    Answers that are merely links are not encouraged, may I interest you writing at least a couple of sentences about the tools?
    – NirIzr
    May 4, 2017 at 7:18
  • I used the tools for malware analysis. And these tools have given successful result. But I like sems more than pafish. May 4, 2017 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.